Skip to content
Threat Feed

Tag

Cyclopsblink

2 briefs RSS
high threat

Linux Iptables Firewall Modification Detection

This brief details a Splunk search that identifies suspicious command-line activity modifying iptables firewall settings on Linux systems, potentially indicating Cyclops Blink malware activity allowing C2 communication by opening specific TCP ports.

ASUS routers Sandworm Tools iptables firewall linux cyclopsblink
2r 1t
medium advisory

Linux Stdout Redirection to /dev/null Indicates Potential Malware Activity

The redirection of standard output to /dev/null on Linux systems, particularly when observed in conjunction with other suspicious activities, can indicate attempts to hide malicious command execution, as seen in malware like Cyclops Blink, potentially leading to unauthorized system modifications and persistent access.

Splunk Enterprise +2 linux malware cyclopsblink anomaly endpoint
2r