New Cuttlefish malware infects routers to monitor traffic for credentials

A new router-targeting malware called Cuttlefish has been observed compromising enterprise and SOHO routers to sniff traffic for cloud-service credentials, create proxy/VPN tunnels (n2n/socks_proxy) for stealthy exfiltration, and hijack internal DNS/HTTP to redirect east-west traffic; Black Lotus Labs reports active campaigns since July 2023 concentrated in Turkey with multi-architecture builds and recommends credential hygiene, firmware updates, TLS/SSL, and device inspection/reboots as mitigations.