Cyclops Blink Evolves Into x86-64 Linux Implant With Packet Sniffing and Internal Network Scanning
Sophos uncovers a new x86-64 Cyclops Blink Linux implant with packet sniffing and internal network scanning on compromised Cisco FMC appliances.
Sophos identified a 64-bit Linux Cyclops Blink implant in August on compromised Cisco Firewall Management Center devices, persisting via SysV init scripts and masquerading as the process 'kworker01'. The modular malware runs five child processes for reconnaissance, file transfer, scanning, packet capture, and persistence, and beacons hourly over outbound TLS to hardcoded C2 89.34.96.56 on ports 43856 and 49172. The family was previously tied to Russian-linked Sandworm activity on WatchGuard appliances, though Sophos treats 2026 attribution cautiously. The packet-capture module applies configurable filters to retain credentials, cookies, and authentication tokens from raw Ethernet traffic.
- Persists via /etc/init.d/timezonecheck SysV script, masquerading as Linux worker process kworker01
- Internal scanner probes admin, VPN, file-sharing, and virtualization ports to map internal networks
- Capture module filters raw traffic for credentials, cookies, and authentication tokens
- C2 uses outbound TLS custom protocol; operators can change servers and timing live
- IoCs include C2 IP 89.34.96.56 and ports 43856, 49172
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 89.34.96.56 | ompromise (IoCs):- Type Indicator Description C2 IP address 89.34.96.56 Hard-coded Cyclops Blink command-and-control server C2 TCP |
From the original article
4 min read at cybersecuritynews.com
Cyclops Blink has returned in a form that gives attackers a deeper view inside corporate networks. The malware was found on compromised Cisco Firewall Management Center devices, where it can maintain remote access, inspect traffic, and map systems behind the network edge. The activity is concerning because management appliances occupy trusted positions.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.