Researchers at Black Lotus Labs have recently reported on a new version of malware targeting small office/home office (SOHO) routers. The Cuttlefish malware is designed to steal traffic relating to credentials and hijack DNS and HTTP traffic associated with communications on the internal network. It is currently unclear how the attackers behind the Cuttlefish malware gain initial access to the victim routers. Once initial access is gained, the attackers deploy a bash script that downloads the Cuttlefish payload and gathers the host data to send back to the attackers’ command-and-control (C2) server. The Cuttlefish malware is built to infect all major router architectures. Its first step is to configure a packet filter that monitors all connections through the router. The filter is coded so that only traffic matching certain criteria is sent back to the C2 server. Cuttlefish searches for any packets with credential markers typically associated with authentication information in GET and POST requests. Researchers note that the packet sniffer emphasizes looking for packets associated with public cloud-based services. Cuttlefish can also hijack traffic destined for a private IP address by redirecting DNS and HTTP requests, which ultimately can allow the attacker to gain access to resources on the internal network. The latest Cuttlefish campaign has been ongoing since October 2023 and has been seen primarily targeting victims in Turkey utilizing one (1) of two (2) telecommunications providers. Cuttlefish is an especially dangerous threat to organizations as it can bypass network segmentation measures and is positioned on the router which often does not support endpoint monitoring technology. CTIX analysts will continue to report on new and evolving forms of malware and associated campaigns.