Skip to content
Threat Feed

Actor

Sandworm Tools

1 brief RSS
high threat

Linux Iptables Firewall Modification Detection

This brief details a Splunk search that identifies suspicious command-line activity modifying iptables firewall settings on Linux systems, potentially indicating Cyclops Blink malware activity allowing C2 communication by opening specific TCP ports.

ASUS routers Sandworm Tools iptables firewall linux cyclopsblink
2r 1t