Sandworm-Linked Cyclops Blink Returns With Network Scanning and Packet-Sniffing Capabilities

A newly identified Cyclops Blink variant has resurfaced on compromised Cisco Secure Firewall Management Center (FMC) appliances, adding active internal-network scanning and programmable packet-sniffing capabilities to an already mature modular implant.

Assessed with high confidence that the activity has a Russian nexus, with a moderate-confidence link to IRON VIKING also tracked as Sandworm and Seashell Blizzard.

Cisco Talos publicly disclosed the broader FMC exploitation activity on September 9, warning that attackers abused two vulnerabilities CVE-2026-20079 and CVE-2026-20316 to gain access, deploy reverse shells and proxy tooling, steal device data, and ultimately install Cyclops Blink.

CVE-2026-20079 is an authentication-bypass flaw that can allow unauthenticated remote attackers to execute scripts and obtain root access on affected FMC devices, while CVE-2026-20316 enables login with a low-privileged account.

The development marks a significant evolution for Cyclops Blink, a malware family publicly attributed by U.S. and UK authorities to the GRU-linked Sandworm operation in 2022.

Earlier samples primarily targeted WatchGuard Firebox devices running 32-bit PowerPC Linux.

The newly observed build is a 64-bit x86-64 ELF implant with generic System V init persistence, potentially making it portable across a wider set of Linux-based network-management, VPN, routing and security appliances.

The timezone_check implant operates through a parent controller and five forked worker modules.

The controller disguises itself as [kworker/0:1], a name intended to resemble legitimate Linux kernel-worker activity in process listings.

It coordinates its modules over dedicated inter-process communication channels, synchronizes configuration, encrypts collected output and relays it over TLS-protected outbound command-and-control connections.

The controller also modifies local firewall policy to preserve its C2 access. It adds iptables OUTPUT-chain ACCEPT rules for TCP ports 43856 and 49172, the ports used by the implant’s C2 communications.

Researchers at Sophos Counter Threat Unit (CTU) analyzed, the 64-bit Linux executable, named timezone_check, in August 2026.

Cyclops Blink variant

The malware contains a hard-coded C2 address, 89[.]34[.]96[.]56, and attempts TLS sessions without conventional certificate validation, then exchanges data through a custom protocol rather than HTTP.

Its C2 configuration can be remotely adjusted: operators can replace C2 addresses, force an immediate beacon, change connection timing, restart the implant or load replacement worker modules.

This modular design provides resilience and allows several surveillance or post-compromise tasks to run concurrently.

The most consequential additions are modules for network discovery and selective traffic collection.

Module 0x11 enumerates locally connected IPv4 networks and scans either attacker-specified ranges or an embedded list of ports linked to administration, file-sharing, web, directory, VPN, VMware and network-management services.

The scanner sends crafted Ethernet, IPv4 and TCP frames over raw packet sockets, identifies open ports through SYN-ACK replies, performs lightweight TCP handshakes and can retrieve HTTP responses or conduct TLS probing.

Its built-in targets include SSH, Telnet, SMB, LDAP, DNS, SNMP, VMware services, HTTP/HTTPS and VPN-related ports.

From an FMC’s privileged position, this capability could expose internal management systems and services not reachable from the public internet.

Module 0x12 adds targeted packet capture. It opens an AF_PACKET raw socket to collect visible Ethernet frames, parses IPv4 TCP and UDP payloads, and searches them using an Aho-Corasick-style multi-pattern matching routine.

Instead of exfiltrating all traffic, operators can configure duration, protocol and address filters, ports, and content terms.

Matching packets are retained in timestamped pcap-style records, potentially exposing cleartext credentials, authentication cookies, access tokens, administrative commands and sensitive application data.

The malware maintains persistence by copying itself to /lib/tz/timezone_check, creating /etc/init.d/timezone_check, and installing SysV startup links for runlevels 2 through 5.

The time zone-themed paths and service name are intended to appear benign. Successful installation also strongly suggests execution with root-level permissions because the implant must write beneath /lib and /etc.

A separate module supports file uploads, HTTP/HTTPS downloads, arbitrary payload execution and in-memory code loading.

It can register downloaded ELF binaries as additional modules, allowing operators to expand the implant without replacing the entire framework.

The module also uses Google Public DNS at 8.8.8.8 over DNS-over-HTTPS access to resolve transfer-host names, bypassing local resolver infrastructure and reducing conventional DNS-log evidence.

The campaign demonstrates why FMC and comparable network-edge management systems must be treated as high-value intrusion points.

Cisco observed UAT-11823 chaining the two FMC flaws before installing a Netcat reverse shell, proxy tools and the Cyclops Blink variant.

Organizations should immediately apply Cisco’s available hotfixes, inspect FMC devices for anomalous SysV services and the timezone_check paths, review outbound TLS sessions on ports 43856 and 49172, and hunt for raw-socket scanning, unusual internal probes and suspicious packet-capture behavior.

The renewed framework is not simply a persistence implant.

On a compromised management-plane appliance, Cyclops Blink can become an internal reconnaissance platform, a selective network-surveillance sensor and a staging point for broader Sandworm-linked operations.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.