Sandworm-Linked Cyclops Blink Returns With Network Scanning and Packet-Sniffing Capabilities
Sophos uncovers a 64-bit Cyclops Blink variant on hacked Cisco FMC appliances, adding internal network scanning and selective packet capture; linked to Sandworm.
Sophos CTU analyzed a new 64-bit x86-64 Cyclops Blink implant (timezone_check) deployed on Cisco Secure Firewall Management Center appliances compromised via CVE-2026-20079 authentication bypass and CVE-2026-20316 low-privileged login. The activity is assessed with high confidence as Russian-nexus, with a moderate-confidence link to Sandworm (IRON VIKING, also tracked as Seashell Blizzard). The implant runs a parent controller plus five worker modules, masquerades as [kworker/0:1], persists via SysV init scripts at /lib/tz/timezone_check, and beacons to hard-coded C2 89.34.96.56 over a custom TLS protocol on ports 43856 and 49172. New module 0x11 scans internal IPv4 networks for SSH, SMB, LDAP, VMware, HTTP/HTTPS and VPN services, while module 0x12 performs filtered packet capture that can expose cleartext credentials, cookies and tokens.
- Variant spreads beyond WatchGuard to 64-bit x86-64 Linux appliances via Cisco FMC flaws CVE-2026-20079 and CVE-2026-20316.
- Controller masquerades as kworker, persists via SysV init scripts, and adds iptables rules for C2 ports 43856 and 49172.
- New modules scan internal networks for SSH, SMB, LDAP, VPN and VMware services and capture filtered packets for credentials.
- Hard-coded C2 89.34.96.56 uses custom TLS protocol; operators can remotely swap C2, timing, and modules.
- Attributed with high confidence to a Russian nexus; moderate-confidence link to Sandworm (IRON VIKING).
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20079 | Authentication bypass to root access in Cisco Secure Firewall Management Center | 10.0 | 88% | KEVPoC ×2 | KEV |
| CVE-2026-20316 | Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center | 5.3 | 35% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 8.8.8.8 | entire framework. The module also uses Google Public DNS at 8.8.8.8 over DNS-over-HTTPS access to resolve transfer-host names, |
| ipv4 | 89.34.96.56 | Blink variant The malware contains a hard-coded C2 address, 89[.]34[.]96[.]56, and attempts TLS sessions without conventional certi |
From the original article
4 min read at gbhackers.com
A newly identified Cyclops Blink variant has resurfaced on compromised Cisco Secure Firewall Management Center (FMC) appliances, adding active internal-network scanning and programmable packet-sniffing capabilities to an already mature modular implant. Assessed with high confidence that the activity has a Russian nexus, with a moderate-confidence link to IRON VIKING also tracked as Sandworm and Seashell […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.