{ "id": "a9b8e5c7-a287-40f9-bf3a-1e188b94cee5", "created_at": "2026-04-06T00:14:02.513826Z", "updated_at": "2026-04-10T03:20:02.637439Z", "deleted_at": null, "sha1_hash": "3933e8841d99d2c423d14c0937ea72fbaabe6d39", "title": "Important Detection and Remediation Actions for Cyclops Blink State-Sponsored Botnet | WatchGuard Technologies", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 42295, "plain_text": "Important Detection and Remediation Actions for Cyclops Blink\r\nState-Sponsored Botnet | WatchGuard Technologies\r\nPublished: 2022-02-23 · Archived: 2026-04-05 18:48:08 UTC\r\nWorking closely with the FBI, CISA, DOJ, and UK NCSC1, WatchGuard has investigated and developed a\r\nremediation for Cyclops Blink, a sophisticated state-sponsored botnet, that may have affected a limited number of\r\nWatchGuard firewall appliances. WatchGuard customers and partners can eliminate the potential threat posed by\r\nmalicious activity from the botnet by immediately enacting WatchGuard’s 4-Step Cyclops Blink Diagnosis and\r\nRemediation Plan.\r\nScope of Potential Impact:\r\nBased on our own investigation, an investigation conducted jointly with Mandiant, and information provided by\r\nthe FBI, WatchGuard has concluded the following:\r\nBased on current estimates, Cyclops Blink may have affected approximately 1% of active WatchGuard\r\nfirewall appliances; no other WatchGuard products are affected.\r\nFirewall appliances are not at risk if they were never configured to allow unrestricted management access\r\nfrom the internet. Restricted management access is the default setting for all WatchGuard’s physical\r\nfirewall appliances.\r\nThere is no evidence of data exfiltration from WatchGuard or its customers.\r\nWatchGuard’s own network has not been affected or breached.\r\nWatchGuard's firewall appliances are primarily used by business customers. As such, we have no reason to believe\r\nthat Cyclops Blink's activities affecting WatchGuard appliances impacted individual consumers.\r\nDetecting, Remediating, and Preventing Cyclops Blink Infection:\r\nIn response to this sophisticated, state-sponsored botnet, WatchGuard has developed and released a set of simple\r\nand easy-to-use Cyclops Blink detection tools, as well as a 4-Step process to help customers diagnose, remediate\r\nif necessary, and prevent future infection. WatchGuard, supported by the FBI, CISA, NSA2, and the UK NCSC,\r\nstrongly recommends that all customers promptly take the actions outlined in the 4-Step Cyclops Blink Diagnosis\r\nand Remediation Plan. Please note that the remediation steps are only necessary if you have an infected appliance;\r\nhowever, the future protection steps are applicable to all customers.\r\nThe recommended 4-Step Cyclops Blink Diagnosis and Remediation Plan includes information to help customers\r\nselect the detection tool most appropriate for their individual needs. It also enables customers to navigate directly\r\nto the most appropriate detection tool and remediation instructions in the event they detect an infection, as well as\r\nto the latest Fireware downloads which contain critical fixes and new mandatory security features for enhanced\r\nfirmware protection.\r\nhttps://www.watchguard.com/wgrd-news/blog/important-detection-and-remediation-actions-cyclops-blink-state-sponsored-botnet\r\nPage 1 of 2\n\nVisit detection.watchguard.com to review and enact the 4-Step Cyclops Blink Diagnosis and Remediation\r\nPlan now.\r\nAdditional Resources\r\nThe team has been working proactively with government authorities, and leading forensic experts, including\r\nMandiant, the FBI, CISA, DOJ, and UK NCSC, to investigate and respond to the attack. We are sharing\r\ninformation across several communications channels in the best interests of our customers, partners, and the\r\ngreater security community. Additional resources are available here:\r\nWatchGuard’s 4-Step Cyclops Blink Diagnosis and Remediation Plan\r\nDetailed Instructions for Enacting the 4-Step Cyclops Blink Diagnosis and Remediation Plan\r\nCyclops Blink Frequently Asked Questions (FAQ)\r\nJoint Government Advisory Issued by the FBI, CISA, NSA, and the UK NCSC\r\nSecurity Best Practices Provided By FBI, CISA, NSA, and UK NCSC (see Further Guidance section)\r\nAs always, WatchGuard Support is available 24/7 to support customers and partners as they implement these\r\nfixes.\r\n \r\n1\r\n Federal Bureau of Investigation, Cybersecurity and Infrastructure Security Agency, Department of Justice, and\r\nUK National Cyber Security Centre.\r\n2\r\n National Security Agency\r\nSource: https://www.watchguard.com/wgrd-news/blog/important-detection-and-remediation-actions-cyclops-blink-state-sponsored-botnet\r\nhttps://www.watchguard.com/wgrd-news/blog/important-detection-and-remediation-actions-cyclops-blink-state-sponsored-botnet\r\nPage 2 of 2", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "references": [ "https://www.watchguard.com/wgrd-news/blog/important-detection-and-remediation-actions-cyclops-blink-state-sponsored-botnet" ], "report_names": [ "important-detection-and-remediation-actions-cyclops-blink-state-sponsored-botnet" ], "threat_actors": [], "ts_created_at": 1775434442, "ts_updated_at": 1775791202, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/3933e8841d99d2c423d14c0937ea72fbaabe6d39.pdf", "text": "https://archive.orkl.eu/3933e8841d99d2c423d14c0937ea72fbaabe6d39.txt", "img": "https://archive.orkl.eu/3933e8841d99d2c423d14c0937ea72fbaabe6d39.jpg" } }