Government release # New Sandworm malware Cyclops Blink replaces VPNFilter National Cyber Security Centre (United Kingdom), February 23, 2022. VPNFilter successor: the joint NCSC/CISA/FBI/NSA advisory of 23 February 2022 identifying Cyclops Blink as a replacement framework for VPNFilter, developed by the same Sandworm actor attributed to the Russian GRU. **Source type:** Government release **Published:** February 23, 2022 **Research grade:** P1 **Used in entries:** 1 ## Bibliographic record **Publisher:** National Cyber Security Centre (United Kingdom) **Published:** February 23, 2022 **Source type:** Government release **Research grade:** Source grade P1 **Language:** English **Official record:** Official publication **Address:** [https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter](https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter) **What it supports:** VPNFilter successor: the joint NCSC/CISA/FBI/NSA advisory of 23 February 2022 identifying Cyclops Blink as a replacement framework for VPNFilter, developed by the same Sandworm actor attributed to the Russian GRU **Dataset id:** src\_ncsc\_cyclops\_blink\_2022 ## Research notes - The page's H1, \ and og:title are all 'New Sandworm malware Cyclops Blink replaces VPNFilter'; the longer 'Joint advisory shows...' phrasing exists only in the URL slug. - The page carries no machine-readable published date; published\_on is the advisory publication date of 23 February 2022 as stated on the page. - NCSC is the UK national technical authority for cyber security, hence P1 rather than a vendor tier. How this source is used Cited 1 time across 1 record type. The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards. Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here. ## Cited by ### Later activity 1 citation Cited for activity recorded after the takedown. - [Cyclops Blink](https://takedownindex.org/takedowns/vpnfilter-botnet-disruption) Same operators, VPNFilter botnet disruption Later outcome [All sources](https://takedownindex.org/sources)