Hidden Malware Framework ‘Cyclops’ Enables Hackers to Execute Custom Commands on Windows Systems

Researchers have recently identified a previously unknown malware framework named “Cyclops.” Developed using the Go programming language, Cyclops has been connected to the notorious hacker collective Charming Kitten, also known as APT 35.

Cyclops allows attackers to run arbitrary commands on infected systems, representing a significant cybersecurity risk, particularly in the Middle East and potentially beyond. The malware was first observed in July 2024, linked to a poorly detected binary associated with the BellaCiao malware, which had also been tied to Charming Kitten.

Cyclops is believed to be an evolution of BellaCiao, with development likely concluding in December 2023. The platform operates via an HTTP REST API exposed through an SSH tunnel, enabling attackers to control the target’s file system and navigate within the compromised network.

Infection Details

The exact deployment method for Cyclops remains unclear. However, based on previous incidents with BellaCiao, it’s suspected that Cyclops could be installed on servers by exploiting vulnerabilities in services such as ASP .NET webshells or Exchange Web server flaws.

The malware masquerades as a legitimate server process with the filename “Microsoft SqlServer.exe.”

Filename: Microsoft SqlServer.exe
Compiler: Go 1.22.4
Hash (SHA256): fafa68e626f1b789261c4dd7fae692756cf71881c7273260af26ca051a094a69

Malware Features

Cyclops is a sophisticated platform written in Go, using the go-svc library to operate as a Windows service. It allows for executing arbitrary commands, manipulating the file system, and using the infected machine to move laterally within the network. The binary’s dependencies point to a development period ending in December 2023, with the Go compiler version 1.22.4 used.

Network Communication

Cyclops encrypts its configuration with AES-128 CBC upon startup, which includes information about its command and control (C2) server. The malware uses SSH tunneling to forward ports and initiates a built-in HTTPS server to manage incoming requests, utilizing a modified gorilla/mux package and basic HTTP authentication.

Configuration Example:

{
    "StartDelay": 5000,
    "SonarConfigs": {
        "Cycle": 1800000,
        "HostName": "lialb.autoupdate[.]uk",
        "HostNameFormat": "%s.%s",
        "ExpectedAddress": [REDACTED]
    },
    "BeamConfigs": {
        "BeamAgent": "SSH-2.2-OpenSSH_for_Windows_8.1",
        "UserName": [REDACTED],
        "Password": [REDACTED],
        "Host": "88.80.145[.]126:443",
        "LocalAddress": "127.0.0.1:9090",
        "RemoteAddress": "127.0.30.3:9090",
        "Retry": 10
    }
}

REST API Control Channel

Cyclops’s REST API control channel is pivotal, allowing operators to issue commands via a single endpoint. The API only accepts POST requests with multipart file format payloads. Commands include arbitrary execution, file transfers, and SSH port forwarding.

Command Structure:

Review: Executes commands using Go’s os.exec package.
Upload/Download: Transfers files between the infected machine and the C2 server.
Port Forwarding: Configures SSH tunnels.
Server Management: Controls the internal HTTPS server, including shutdown.

Infrastructure and Attribution

Cyclops relies on domain name resolution similar to BellaCiao. Operators manage DNS resolutions through their own name servers, overseeing execution flow.

The infrastructure analysis links Cyclops to Charming Kitten, an actor associated with Iran’s Islamic Revolutionary Guard Corps (IRGC). However, definitive attribution requires more evidence.

Cyclops has been detected targeting a Lebanese non-profit and a telecommunications company in Afghanistan. The malware’s limited distribution indicates it is in its early stages, highlighting the evolving capabilities of Charming Kitten and the persistent cybersecurity threat in the region.

Indicators of Compromise (IOCs)

Hashes (SHA-256):

fafa68e626f1b789261c4dd7fae692756cf71881c7273260af26ca051a094a69 | Cyclops

Domains:

autoupdate[.]uk | Cyclops validator

IP Addresses:

88.80.145.126 | Cyclops SSH C2 and validator NS

This analysis offers crucial insights into Cyclops’s capabilities and infrastructure, underscoring the need for vigilance and improved detection measures to combat such advanced threats.

CYPHERLOCK, INC.