'Cuttlefish' Zero-Click Malware Steals Private Cloud Data

Black Lotus Labs discovered a previously unseen modular malware named “Cuttlefish” that compromises SOHO and enterprise routers to sniff traffic, hijack DNS/HTTP for private IP connections, and steal authentication credentials—especially for cloud services—by tunneling exfiltration through compromised routers. The campaign has been active since at least July, with the majority of infections (~600 unique IPs) in Turkey, supports multiple architectures, is configured via C2-delivered rules to target specific traffic patterns, and shows code similarities to HiatusRAT; the researchers provide IoCs and mitigation advice for both enterprise defenders and consumer SOHO operators.