Government release
New Sandworm malware Cyclops Blink replaces VPNFilter
National Cyber Security Centre (United Kingdom), February 23, 2022. VPNFilter successor: the joint NCSC/CISA/FBI/NSA advisory of 23 February 2022 identifying Cyclops Blink as a replacement framework for VPNFilter, developed by the same Sandworm actor attributed to the Russian GRU.
- Source type
- Government release
- Published
- February 23, 2022
- Research grade
- P1
- Used in entries
- 1
Bibliographic record
- Publisher
- National Cyber Security Centre (United Kingdom)
- Published
- February 23, 2022
- Source type
- Government release
- Research grade
- Source grade P1
- Language
- English
- Official record
- Official publication
- What it supports
- VPNFilter successor: the joint NCSC/CISA/FBI/NSA advisory of 23 February 2022 identifying Cyclops Blink as a replacement framework for VPNFilter, developed by the same Sandworm actor attributed to the Russian GRU
- Dataset id
- src_ncsc_cyclops_blink_2022
Research notes
- The page's H1, <title> and og:title are all 'New Sandworm malware Cyclops Blink replaces VPNFilter'; the longer 'Joint advisory shows...' phrasing exists only in the URL slug.
- The page carries no machine-readable published date; published_on is the advisory publication date of 23 February 2022 as stated on the page.
- NCSC is the UK national technical authority for cyber security, hence P1 rather than a vendor tier.
How this source is used
Cited 1 time across 1 record type.
The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.
Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here.
Cited by
Later activity
1 citation
Cited for activity recorded after the takedown.
-
Cyclops BlinkLater outcome
Same operators, VPNFilter botnet disruption