Kiran 
A revamped version of the Cyclops Blink malware is actively compromising Cisco Firewall Management Center (FMC) appliances, marking the first confirmed reappearance of the Russia-linked implant since its 2022 takedown.
The upgraded strain, disguised as a file called timezone_check, now runs on 64-bit x86-64 Linux systems and packs far more aggressive reconnaissance and surveillance tools than its predecessor.
CTU researchers first analyzed the malware in August 2026 after spotting it on several breached FMC devices. Cisco’s Talos team publicly detailed the campaign on September 9, prompting Sophos to release its own findings.
Sandworm’s Cyclops Blink Malware Evolves
Unlike the 2022 variant, which targeted 32-bit PowerPC-based WatchGuard Firebox appliances and modified vendor firmware to survive updates, the 2026 version uses generic System V (SysV) init persistence, a technique that works across a broad swath of Linux-based network appliances, not just one vendor’s hardware.
That architectural shift could extend the malware’s reach to SD-WAN controllers, VPN concentrators, and other centrally managed platforms with compatible Linux environments.
Cyclops Blink’s core design hasn’t changed: a stealthy controller process disguised as the innocuous-looking [kworker/0:1] coordinates five specialized worker modules over encrypted inter-process channels.
The 2026 build adds two entirely new capabilities absent from the 2022 sample: an active network scanner (module 0x11) that probes internal IP ranges and dozens of high-value ports, from SSH and SNMP to VMware and VPN services, and a packet-capture module (0x12) that uses an Aho-Corasick pattern-matching engine to selectively harvest credentials, tokens, and other sensitive traffic in near real time.
A file-transfer and execution module (0x0F) can also fetch and load new ELF payloads as additional modules on the fly, effectively letting operators reprogram the implant post-compromise.
Communications route through TLS to a hard-coded C2 address (89.34.96.56) over ports 43856 or 49172, with certificate validation deliberately disabled and a custom binary protocol layered underneath.
Harvested data gets an extra layer of RSA-3072 encryption before it ever leaves the device. Persistence relies on copying the binary to /lib/tz/timezone_check and registering it as a SysV service across runlevels 2–5 a low-tech but effective method that requires root-level access to install.
CTU assesses with high confidence that the campaign has a Russian nexus, and with moderate confidence that it’s tied to IRON VIKING the group also tracked as Sandworm or Seashell Blizzard, previously blamed for the original Cyclops Blink campaigns.
The moderate confidence reflects the lack of direct evidence linking this specific 2026 deployment to the group, despite strong code-level continuity with the 2022 implant.
Because the malware no longer depends on WatchGuard-specific firmware tricks, organizations running any Linux-based network-management appliance not just Cisco FMC should hunt for the documented indicators: the C2 IP, the timezone_check file path, and a telltale malformed User-Agent string mixing Firefox and Chrome tokens.
Given the implant’s privileged vantage point on management infrastructure, early detection is critical before it pivots deeper into internal networks.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
George antony 
