Do Son 
Cyclops Blink architecture | Image: Sophos Counter Threat Unit
At a glance
- Malware family: Cyclops Blink
- Threat actor: Suspected IRON VIKING (Sandworm / Russian nexus)
- Targets or victims: Multiple compromised Cisco Firewall Management Center (FMC) devices
- Delivery vector: Unspecified (presumed vulnerability exploitation or compromised credentials)
- Key capabilities: Host reconnaissance, file transfer, network scanning, packet capture, modular persistence
- Source: Sophos Counter Threat Unit (CTU)
TL;DR
Sophos Counter Threat Unit researchers recently uncovered a newly upgraded 64-bit Linux variant of the Cyclops Blink malware. Threat actors deployed this modular implant across multiple compromised Cisco FMC devices. The malware features extensive upgrades, including programmable packet surveillance and active internal network discovery.
Delivery
Researchers identified the Cyclops Blink malware on several Cisco FMC devices, indicating a significant shift from earlier attack campaigns. Previously, the malware primarily targeted 32-bit PowerPC architecture on small office routers. The new variant runs natively on x86-64 Linux architecture and utilizes generic System V persistence mechanisms. This generic approach substantially broadens the range of compatible network edge appliances.
While the exact initial access method remains unconfirmed, attackers typically breach such management appliances through unpatched vulnerabilities. Exposed administrative credentials also provide a common entry path. Software-defined wide area network controllers and virtual private network concentrators represent highly plausible targets. Organizations often deploy these network appliances at the perimeter. This placement makes them lucrative targets for initial access operations. Threat actors value these edge devices because they rarely support traditional endpoint detection tools.
Infection Chain
The malware functions as a highly capable, modular framework built around a parent controller and five distinct child-process worker modules. Upon execution, the controller attempts to blend into normal system operations by masquerading as a standard background kernel thread. “The controller masquerades as a process named [kworker/0:1] to blend into Linux process listings and reduce the likelihood of casual discovery,” the report explains. Genuine kernel worker threads perform standard background tasks and appear frequently on healthy Linux systems.
Once the controller establishes itself, it creates dedicated inter-process communication channels for each worker module. The controller isolates module failures by allocating separate processes for different tasks. It distributes a fixed-size status structure containing critical session values and routing information to all registered modules. To achieve persistence, the implant relocates its executable file to a system directory. It creates an executable initialization script using a built-in shell template and registers this script as a startup service. “Unlike the WatchGuard-focused samples documented in 2022, the 2026 variant runs on x86-64 Linux and uses generic System V (SysV) persistence rather than vendor-specific firmware modification,” the report states. This generic installation mechanism ensures the malware activates automatically upon system reboot.
Command-and-Control and Data-Exfiltration Behaviour
The Cyclops Blink malware communicates with its command-and-control infrastructure through outbound transmission control protocol connections. Strong encryption protects this external communication. During initialization, the controller modifies local firewall policies by adding rules to the outbound chain. This modification ensures the compromised host permits external connections to specific operator-controlled ports.
The implant utilizes a dedicated reconnaissance module to collect detailed system and network configuration data. The malware actively scans adjacent networks to map internal environments, transmitting the findings back to the operators. “The implant’s expanded capabilities include active network and service discovery, programmable packet surveillance, file transfer, and payload execution.” The network discovery module enumerates locally connected subnets and probes a pre-defined list of ports associated with valuable management services.
For data exfiltration, the malware implements programmable network traffic surveillance. A dedicated packet capture module monitors visible network traffic and selectively retains data that matches operator-defined content patterns. This capability enables attackers to harvest cleartext credentials, session cookies, and authentication tokens without generating excessive outbound traffic. The malware compiles supplied search patterns into an efficient matching engine, allowing simultaneous searches for multiple string values.
A file transfer module provides further post-compromise flexibility. This component downloads additional payloads from external web servers and executes them directly in memory. Running payloads in memory helps the malware leave minimal forensic traces on the physical storage disk. An embedded domain name resolver allows the implant to bypass local DNS logs entirely when looking up transfer destinations. The module sends binary DNS queries directly to public resolvers via secure HTTP connections.
Defense or Detection Guidance
Analysts assess with moderate confidence that the Russia-based IRON VIKING threat group directs this campaign. The discovery of this malware on network management appliances highlights severe risks for enterprise environments. A compromised management center grants attackers deep visibility across multiple network segments. It also provides a trusted platform for lateral movement inside the corporate perimeter.
Network administrators must expand their threat hunting efforts beyond individual compromised endpoints. Security teams should proactively monitor Linux-based network appliances for suspicious background processes mimicking kernel threads. Since the malware modifies local firewall rules to permit outbound traffic, defenders must audit outbound network policies and block unauthorized connections to unrecognized external addresses.
Furthermore, researchers analyzing the Cyclops Blink malware campaign advise inspecting system startup directories for unexpected initialization scripts. Security personnel should regularly rotate administrative credentials and apply all vendor security patches to network edge devices. Organizations should restrict management interfaces to trusted internal networks and monitor them strictly for anomalous access patterns.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
