Cuttlefish Malware Threatens Routers

A newly identified malware, dubbed 'Cuttlefish,' has emerged as a significant threat to both enterprise and small office/home office routers. This malicious software is designed to monitor and steal authentication data by infecting routers and creating a covert channel to exfiltrate information, effectively bypassing conventional security measures.

Stealthy Data Exfiltration

Cuttlefish operates by establishing a proxy or VPN tunnel within the compromised router, allowing it to discreetly funnel out sensitive data. It's capable of DNS and HTTP hijacking, which disrupts internal communications and could potentially introduce additional malicious payloads.

Undetermined Origins

While there are similarities between Cuttlefish and HiatusRat, a malware linked to Chinese state interests, a definitive connection remains elusive. Active since July 2023, Cuttlefish's current campaign is primarily targeting Turkey, with some instances affecting satellite and data center services globally.

Infection Tactics

The initial infection method is unclear, but it may involve exploiting known vulnerabilities or brute-forcing credentials. Once inside, Cuttlefish deploys a bash script that collects system data and downloads the main payload, which operates in-memory to avoid detection.

Cuttlefish comes in various builds to support most router architectures, ensuring widespread vulnerability. It uses packet filtering to monitor all connections and searches for credential markers, targeting credentials related to public cloud services.

Preventive Measures

To combat this threat, Black Lotus Labs recommends eliminating weak credentials, monitoring for unusual logins, securing traffic with encryption, inspecting devices for anomalies, and regular reboots. For SOHO routers, users should update firmware, change default passwords, block remote management access, and replace outdated devices.

Cuttlefish represents a severe risk to organizations by circumventing network segmentation and endpoint monitoring, allowing attackers to remain undetected in cloud environments. Vigilance and proactive security measures are essential to protect against such sophisticated threats.

‍