Cyclops Blink Evolves Into x86-64 Linux Implant With Packet Sniffing and Internal Network Scanning

Cyclops Blink has returned in a form that gives attackers a deeper view inside corporate networks. The malware was found on compromised Cisco Firewall Management Center devices, where it can maintain remote access, inspect traffic, and map systems behind the network edge.

The activity is concerning because management appliances occupy trusted positions. Recent reporting that covered attackers gaining root access shows how a breach at this layer can expose configurations, credentials, and paths to systems that are otherwise difficult to reach.

Analysts at Sophos identified the new implant in August while examining a malicious 64-bit Linux executable on several compromised appliances.

Their analysis connects it to Cyclops Blink, a modular malware family previously tied to Russian-linked Sandworm activity, while treating attribution for the 2026 deployments with appropriate caution.

Sophos said in a report shared with Cyber Security News (CSN) that it did not establish the initial access route in the analyzed incidents.

Still, the affected environment has faced serious web-management risks, including embedded credentials exploitation that allowed unauthenticated access and could be chained with other weaknesses to increase control.

Cyclops Blink Evolves Into x86-64 Linux Implant

The latest sample is a 64-bit x86-64 Linux executable, a significant change from the older PowerPC version documented on WatchGuard devices.

Instead of altering vendor firmware, it relies on standard SysV startup services, making its persistence approach more portable across compatible Linux appliances.

With sufficient privileges, the implant relocates itself to a system directory and registers a startup script so it launches after a reboot.

It also makes its controller resemble an ordinary Linux worker process, an attempt to blend into routine process listings and reduce the chance of casual discovery.

The malware divides work among five child-process modules. The structure allows reconnaissance, file movement, scanning, packet collection, and persistence to operate separately while a parent controller manages commands and protected communications.

The implant profiles the host and its nearby network, collecting operating-system, account, process, storage, interface, and resolver details.

Where permissions permit, it may retrieve password hashes. Its transfer component can exfiltrate accessible files, download further tools over HTTP or HTTPS, execute them, or load Linux code directly into memory.

This flexibility matters on a network-management platform. An attacker could use one compromised device as an intelligence point, a staging area for follow-on payloads, and a durable foothold with visibility into privileged management networks and multiple internal address ranges.

Its command-and-control channel uses outbound TLS connections and a custom protocol instead of ordinary web traffic. Samples beaconed hourly in observed incidents, but operators can change the server list and connection timing while the implant is running.

This behavior can complicate network blocking and incident-response correlation. Defenders should record timing changes and destinations carefully.

Scanning Turns Devices Into Sensors

The internal scanner identifies locally connected IPv4 networks and tests either operator-selected ports or a built-in list linked to administration, file sharing, messaging, directory services, web applications, network monitoring, VPNs, and virtualization.

It can collect basic service responses and perform web or TLS probing. That capability turns an infected management appliance into more than a foothold.

It can reveal internal systems that are not exposed to the internet and help attackers select targets for later movement, a risk illustrated by coverage of FMC root-level code execution that could give intruders broad control.

A separate capture module listens for raw Ethernet traffic visible to the host and retains packets matching attacker-defined terms.

Configurable time, address, port, and content filters let operators focus on credentials, cookies, authentication tokens, administrative commands, or sensitive application requests rather than collecting everything.

Organizations should extend hunting beyond the devices already identified and examine compatible Linux network appliances for the documented filesystem, process, network, and cryptographic signs.

They should promptly apply available security fixes, tightly restrict management access, review outbound encrypted connections, and investigate unusual services after Cisco firewall active exploitation in reported attacks.

Indicators fo compromise (IoCs):-

Type	Indicator	Description
C2 IP address	89.34.96.56	Hard-coded Cyclops Blink command-and-control server
C2 TCP ports	43856, 49172	Outbound ports used for Cyclops Blink command-and-control communications
File path	/lib/tz/timezonecheck	Persistent installation location used by the analyzed 2026 samples
File name	timezonecheck	Name used by the malicious Linux executable and persistence component
Init service	/etc/init.d/timezonecheck	SysV init script created to launch the implant
Startup links	/etc/rc2.d/S89timezonecheck, /etc/rc3.d/S89timezonecheck, /etc/rc4.d/S89timezonecheck, /etc/rc5.d/S89timezonecheck	SysV runlevel startup links used for persistence
Process name	kworker01	Controller process name intended to resemble a normal Linux worker process
User-Agent	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Chrome/129.0.0	Distinctive HTTP and DNS-over-HTTPS request header used by the malware

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.