42
42
57
57
57
57
42
Sandworm-Linked Cyclops Blink Returns With Network Scanning and Packet-Sniffing Capabilities
Sophos uncovers a 64-bit Cyclops Blink variant on hacked Cisco FMC appliances, adding internal network scanning and selective packet capture; linked to Sandworm.
Sophos CTU analyzed a new 64-bit x86-64 Cyclops Blink implant (timezone_check) deployed on Cisco Secure Firewall Management Center appliances compromised via CVE-2026-20079 authentication bypass and CVE-2026-20316 low-privileged login. The activity is assessed with high confidence as Russian-nexus, with a moderate-confidence link to Sandworm (IRON VIKING, also tracked as Seashell Blizzard). The implant runs a parent controller plus five worker modules, masquerades as [kworker/0:1], persists via SysV init scripts at /lib/tz/timezone_check, and beacons to hard-coded C2 89.34.96.56 over a custom TLS protocol on ports 43856 and 49172. New module 0x11 scans internal IPv4 networks for SSH, SMB, LDAP, VMware, HTTP/HTTPS and VPN services, while module 0x12 performs filtered packet capture that can expose cleartext credentials, cookies and tokens.
78
57
57
42
57
Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
CERT-UA says Sandworm-linked UAC-0145 poses as recruiters in fake job interviews to deliver a trojanized WireGuard VPN that runs attacker commands on victims' hosts.
CERT-UA attributes the campaign, ongoing since May 2026, to UAC-0145, a subgroup within GRU-affiliated Sandworm (APT44). Posing as HR staff of firms like ATLAS Business Group and Sopra Steria Bulgaria, attackers lure Ukrainian IT specialists into Zoom interviews, then share failing WireGuard configs and push a custom SopraVPN client from SourceForge. The modified WireGuard build supports a non-standard SymmetricKey option holding AES-256-GCM-encrypted PowerShell, decrypted with the decoded PrivateKey and executed via runScriptCommand. A scheduled task then downloads a second-stage payload on Windows, while the Linux variant fetches it via cURL.
72
60
42
'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink
Russia-linked Sandworm chains Cisco vulnerabilities to deploy an upgraded Cyclops Blink botnet variant the FBI disrupted in 2022.
Dark Reading reports that Sandworm, the notorious Russia-linked threat group, is chaining Cisco vulnerabilities to deploy an upgraded version of the Cyclops Blink botnet malware. The FBI previously disrupted the Cyclops Blink botnet in 2022. The activity signals renewed botnet infrastructure building by the group despite prior law-enforcement action.
70
57
57
57
57
57
42
42
42
42
42
57
42
42
57
57
57
47
42
Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers
Cisco Talos confirms ransomware and state-sponsored groups exploited CVE-2026-20079 and CVE-2026-20316 in Secure Firewall Management Center, deploying Qilin ransomware and Cyclops Blink.
Cisco Talos identified three threat clusters (UAT-12197, UAT-11823, UAT-11988) exploiting CVE-2026-20079, a CVSS 10.0 authentication bypass, and CVE-2026-20316, a CVSS 5.3 static-credential flaw, in Cisco Secure Firewall Management Center. Qilin affiliates used static credentials for reconnaissance and deployed Qilin ransomware; a Sandworm-linked cluster deployed a Cyclops Blink backdoor via a malicious license.tmp file; a third cluster stole credentials through a JSP web shell. Cisco has released hotfixes and urges immediate installation, with broader patches expected next week.
82
42
42
60
60
42