Since June 2019, the malware Cyclops Blink has been used by the Sandworm hackers to attack WatchGuard Firebox firewall appliances and several ASUS router models, utilizing CVE-2022-23176 exploits. It provides persistence on devices through firmware updates and grants its operators remote access to infected networks. Also, it injects malicious code and deploys repacked firmware images through legitimate firmware update channels on infected devices to maintain access to the compromised devices. The malware is modular, which simplifies updating and targeting new devices and security flaws. The Cyclops Blink botnet was disrupted by US government officials before it was weaponized and deployed in assaults. Before cleaning the Cyclops Blink infestation, the FBI uninstalled the malware from Watchguard devices identified as command and control servers, alerting owners of affected devices in the United States and internationally. In order to avoid further infections, WatchGuard has given instructions for cleaning infected Firebox appliances and updating them to the current Fireware OS version.

https://www.bleepingcomputer.com/news/security/cisa-warns-orgs-of-watchguard-bug-exploited-by-russian-state-hackers/