cyclops

Executive Summary

Cyclops is a medium-sophistication criminal threat actor group operational since June 2023, primarily targeting Ransomware-as-a-Service (RaaS) operations. They initially targeted Windows systems but expanded to macOS and Linux before rebranding as 'Knight' in August 2023. The group focuses on financial gain through ransomware campaigns, leveraging their cross-platform capabilities to maximize impact.

Goals & Targeting

Cyclops primarily targets organizations for financial gain through ransomware payloads. Their cross-platform approach indicates targeting of diverse industries and regions, likely focusing on sectors with higher organizational assets and slower patch management cycles. The group's rebranding suggests an attempt to expand their operational reach and affiliate base.

Cyclops emerged in May 2023 as a notable Ransomware-as-a-Service (RaaS) operator, initially targeting Windows systems before expanding to macOS and Linux platforms. The group rebranded to 'Knight' by August 2023 and later sold its codebase, with affiliates shifting to using RansomHub. Cyclops operates with a clear focus on criminal profit through ransomware, making it a significant player in the evolving cybercrime landscape.

Key Capabilities

• Ransomware development
• Cross-platform attacks (Windows, macOS, Linux)
• Rebranding for continued operations
• Affiliate program management

Software / Tooling

Campaigns & Victims

Cyclops' campaigns are characterized by their rapid operational evolution and shift to more established RaaS platforms. Their rebranding as 'Knight' suggests attempts to expand their affiliate network after selling their original codebase, indicating a pragmatic approach to sustaining operations.

IOC Patterns

• Spear-phishing with malicious links
• Distribution of cross-platform ransomware payloads

Recommended Actions

• Enhance visibility and logging for lateral movement and data exfiltration attempts
• Implement strong email security measures against phishing campaigns
• Patch systems regularly to mitigate vulnerabilities exploited in attacks

Suggested Tags