Sandworm-Linked Cyclops Blink Returns With Community Scanning and Packet-Sniffing Capabilities

A newly recognized Cyclops Blink variant has resurfaced on compromised Cisco Safe Firewall Administration Heart (FMC) home equipment, including lively internal-network scanning and programmable packet-sniffing capabilities to an already mature modular implant.

Assessed with excessive confidence that the exercise has a Russian nexus, with a moderate-confidence hyperlink to IRON VIKING additionally tracked as Sandworm and Seashell Blizzard.

Cisco Talos publicly disclosed the broader FMC exploitation exercise on September 9, warning that attackers abused two vulnerabilities CVE-2026-20079 and CVE-2026-20316 to achieve entry, deploy reverse shells and proxy tooling, steal gadget information, and in the end set up Cyclops Blink.

CVE-2026-20079 is an authentication-bypass flaw that may permit unauthenticated distant attackers to execute scripts and procure root entry on affected FMC units, whereas CVE-2026-20316 allows login with a low-privileged account.

The event marks a big evolution for Cyclops Blink, a malware household publicly attributed by U.S. and UK authorities to the GRU-linked Sandworm operation in 2022.

Earlier samples primarily focused WatchGuard Firebox units working 32-bit PowerPC Linux.

The newly noticed construct is a 64-bit x86-64 ELF implant with generic System V init persistence, doubtlessly making it moveable throughout a wider set of Linux-based network-management, VPN, routing and safety home equipment.

The timezone_check implant operates via a dad or mum controller and 5 forked employee modules.

The controller disguises itself as [kworker/0:1], a reputation meant to resemble respectable Linux kernel-worker exercise in course of listings.

It coordinates its modules over devoted inter-process communication channels, synchronizes configuration, encrypts collected output and relays it over TLS-protected outbound command-and-control connections.

The controller additionally modifies native firewall coverage to protect its C2 entry. It provides iptables OUTPUT-chain ACCEPT guidelines for TCP ports 43856 and 49172, the ports utilized by the implant’s C2 communications.

Researchers at Sophos Counter Menace Unit (CTU) analyzed, the 64-bit Linux executable, named timezone_check, in August 2026.

Cyclops Blink variant

The malware incorporates a hard-coded C2 handle, 89[.]34[.]96[.]56, and makes an attempt TLS periods with out standard certificates validation, then exchanges information via a customized protocol slightly than HTTP.

Its C2 configuration could be remotely adjusted: operators can change C2 addresses, pressure an instantaneous beacon, change connection timing, restart the implant or load alternative employee modules.

This modular design gives resilience and permits a number of surveillance or post-compromise duties to run concurrently.

Probably the most consequential additions are modules for community discovery and selective visitors assortment.

Module 0x11 enumerates regionally linked IPv4 networks and scans both attacker-specified ranges or an embedded listing of ports linked to administration, file-sharing, net, listing, VPN, VMware and network-management providers.

The scanner sends crafted Ethernet, IPv4 and TCP frames over uncooked packet sockets, identifies open ports via SYN-ACK replies, performs light-weight TCP handshakes and might retrieve HTTP responses or conduct TLS probing.

Its built-in targets embrace SSH, Telnet, SMB, LDAP, DNS, SNMP, VMware providers, HTTP/HTTPS and VPN-related ports.

From an FMC’s privileged place, this functionality might expose inside administration programs and providers not reachable from the general public web.

Module 0x12 provides focused packet seize. It opens an AF_PACKET uncooked socket to gather seen Ethernet frames, parses IPv4 TCP and UDP payloads, and searches them utilizing an Aho-Corasick-style multi-pattern matching routine.

As an alternative of exfiltrating all visitors, operators can configure length, protocol and handle filters, ports, and content material phrases.

Matching packets are retained in timestamped pcap-style data, doubtlessly exposing cleartext credentials, authentication cookies, entry tokens, administrative instructions and delicate software information.

The malware maintains persistence by copying itself to /lib/tz/timezone_check, creating /and so on/init.d/timezone_check, and putting in SysV startup hyperlinks for runlevels 2 via 5.

The time zone-themed paths and repair title are meant to seem benign. Profitable set up additionally strongly suggests execution with root-level permissions as a result of the implant should write beneath /lib and /and so on.

A separate module helps file uploads, HTTP/HTTPS downloads, arbitrary payload execution and in-memory code loading.

It may possibly register downloaded ELF binaries as further modules, permitting operators to broaden the implant with out changing your complete framework.

The module additionally makes use of Google Public DNS at 8.8.8.8 over DNS-over-HTTPS entry to resolve transfer-host names, bypassing native resolver infrastructure and lowering standard DNS-log proof.

The marketing campaign demonstrates why FMC and comparable network-edge administration programs should be handled as high-value intrusion factors.

Cisco noticed UAT-11823 chaining the 2 FMC flaws earlier than putting in a Netcat reverse shell, proxy instruments and the Cyclops Blink variant.

Organizations ought to instantly apply Cisco’s out there hotfixes, examine FMC units for anomalous SysV providers and the timezone_check paths, evaluate outbound TLS periods on ports 43856 and 49172, and hunt for raw-socket scanning, uncommon inside probes and suspicious packet-capture habits.

The renewed framework is just not merely a persistence implant.

On a compromised management-plane equipment, Cyclops Blink can develop into an inside reconnaissance platform, a selective network-surveillance sensor and a staging level for broader Sandworm-linked operations.

IOCs

Be aware: IP addresses and domains are deliberately defanged (e.g., [.]) to stop unintended decision or hyperlinking. Re-fang solely inside managed menace intelligence platforms similar to MISP, VirusTotal, or your SIEM.

★ Study 7 Metric-Gated AI SOC Deployment Phases – Obtain Free AI SOC Deployment Playbook 2026.