Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Sophos Finds Cyclops Blink on Cisco Firewall Management Systems

Part of the Sandworm story · since 29 Oct 2025

Quiet for 6 dayslast report 23 Oct20 articles9 outlets
29 Oct · Security Affairs first30 Apr1 Jul1 SepNowThis article18th of 20
  • Wed 29 Oct, 15:50 UTC. Security Affairs, first report. Russian hackers, likely linked to Sandworm, exploit legitimate tools against Ukrainian targets.
  • Sat 1 Nov, 12:46 UTC. SecurityOnline, its first report on the story. Sandworm APT Attacks Belarus Military With LNK Exploit and OpenSSH Over Tor obfs4 Backdoor.
  • Fri 7 Nov, 05:50 UTC. GBHackers, its first report on the story. Sandworm Hackers Target Ukrainian Organizations With Data-Wiping Malware.
  • Wed 17 Dec, 03:50 UTC. SecurityOnline. Sandworm’s Tactical Pivot: Russian GRU Abandons Zero-Days to Weaponize Misconfigured Edge Devices.
  • Sat 24 Jan, 08:56 UTC. The Hacker News, its first report on the story. New DynoWiper Malware Used in Attempted Sandworm Attack on Polish Power Sector.
  • Mon 26 Jan, 08:36 UTC. Security Affairs. Russia-linked Sandworm APT implicated in major cyber attack on Poland’s power grid.
  • Mon 26 Jan, 09:10 UTC. SecurityWeek, its first report on the story. Russian Sandworm Hackers Blamed for Cyberattack on Polish Power Grid.
  • Mon 26 Jan, 22:11 UTC. Dark Reading, its first report on the story. Sandworm Blamed for Wiper Attack on Poland Power Grid.
  • Wed 28 Jan, 17:51 UTC. The Hacker News. Russian ELECTRUM Tied to December 2025 Cyber Attack on Polish Power Grid.
  • Thu 9 Jul, 15:07 UTC. Dark Reading. Ukrainian Tax Firm Hit by Sandworm Warns Global Businesses.
  • Thu 16 Jul, 19:46 UTC. Ars Technica, its first report on the story. Sandworm uses CAPTCHAs to deliver FreakyPoll malware in Ukraine.
  • Sun 19 Jul, 14:48 UTC. The Hacker News. UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware.
  • Mon 10 Aug, 10:17 UTC. SecurityWeek. Poland’s grid hit again by Sandworm via Fortinet VPN.
  • Tue 11 Aug, 18:57 UTC. The Hacker News. Sandworm Group Uses Fake Job VPN to Hijack Devices.
  • Wed 12 Aug, 09:51 UTC. Infosecurity, its first report on the story. Sandworm hits Polish power plant via private APN, brief outage.
  • Thu 27 Aug, 20:46 UTC. dti.domaintools.com, its first report on the story. Leak shows Moscow university training cyber troops for Russia.
  • Thu 10 Sep, 10:30 UTC. SecurityWeek. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 16:00 UTC. SecurityOnline. Sophos Finds Cyclops Blink on Cisco Firewall Management Systems. This article, 18th of 20.
  • Mon 14 Sep, 22:16 UTC. Dark Reading. Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 12:00 UTC. The Hacker News. Sandworm Used Yggdrasil Network in Destructive Ukraine Wiper Attack.

Sophos Counter Threat Unit (CTU) researchers have identified a new 64-bit Linux variant of the Cyclops Blink malware on multiple compromised Cisco Firewall Management Center (FMC) devices. The malware previously focused mainly on 32-bit PowerPC-based small-office routers, but this version runs on x86-64 Linux and uses generic System V persistence, potentially expanding its use across network-edge appliances.

The initial access method has not been confirmed; the report says exploitation of unpatched vulnerabilities or the use of exposed administrative credentials are possible routes.

The implant uses a parent controller and five worker modules. It disguises its controller as the Linux process “kworker/0:1”, installs a startup script to survive reboots and communicates with operators over encrypted outbound TCP connections. Its capabilities include host reconnaissance, internal network and service discovery, programmable packet capture, file transfer and in-memory payload execution.

Packet monitoring can selectively search traffic for operator-defined strings, potentially exposing cleartext credentials, session cookies and authentication tokens. The malware also changes local firewall rules to allow connections to specified external ports.

CTU assesses with moderate confidence that the campaign is linked to the Russia-based IRON VIKING group, also associated with Sandworm. Cisco FMC compromise could provide visibility into several network segments and support lateral movement, although the article does not report a confirmed delivery vulnerability or a named victim.

Recommended defensive measures include inspecting Linux appliances for processes mimicking kernel threads and unexpected startup scripts, auditing outbound firewall rules, applying vendor patches, rotating administrative credentials, restricting management interfaces and investigating unusual access.

How the story developed

All 20 articles
Quiet for 6 dayslast report 23 Oct20 articles9 outlets

20 articles from 9 outlets since 29 Oct. Quiet since 23 Oct. This was the 18th report, 320 days after the first.

Now29 Oct2153115316 Jul2813291430First reportSecurity Affairs · 29 Oct, 15:50This article18th of 20 · day 320Exploited CVESecurityWeek · 10 Sep
  • Wed 29 Oct, 15:50 UTC. Security Affairs, first report. Russian hackers, likely linked to Sandworm, exploit legitimate tools against Ukrainian targets.
  • Sat 1 Nov, 12:46 UTC. SecurityOnline, its first report on the story. Sandworm APT Attacks Belarus Military With LNK Exploit and OpenSSH Over Tor obfs4 Backdoor.
  • Fri 7 Nov, 05:50 UTC. GBHackers, its first report on the story. Sandworm Hackers Target Ukrainian Organizations With Data-Wiping Malware.
  • Wed 17 Dec, 03:50 UTC. SecurityOnline. Sandworm’s Tactical Pivot: Russian GRU Abandons Zero-Days to Weaponize Misconfigured Edge Devices.
  • Sat 24 Jan, 08:56 UTC. The Hacker News, its first report on the story. New DynoWiper Malware Used in Attempted Sandworm Attack on Polish Power Sector.
  • Mon 26 Jan, 08:36 UTC. Security Affairs. Russia-linked Sandworm APT implicated in major cyber attack on Poland’s power grid.
  • Mon 26 Jan, 09:10 UTC. SecurityWeek, its first report on the story. Russian Sandworm Hackers Blamed for Cyberattack on Polish Power Grid.
  • Mon 26 Jan, 22:11 UTC. Dark Reading, its first report on the story. Sandworm Blamed for Wiper Attack on Poland Power Grid.
  • Wed 28 Jan, 17:51 UTC. The Hacker News. Russian ELECTRUM Tied to December 2025 Cyber Attack on Polish Power Grid.
  • Thu 9 Jul, 15:07 UTC. Dark Reading. Ukrainian Tax Firm Hit by Sandworm Warns Global Businesses.
  • Thu 16 Jul, 19:46 UTC. Ars Technica, its first report on the story. Sandworm uses CAPTCHAs to deliver FreakyPoll malware in Ukraine.
  • Sun 19 Jul, 14:48 UTC. The Hacker News. UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware.
  • Mon 10 Aug, 10:17 UTC. SecurityWeek. Poland’s grid hit again by Sandworm via Fortinet VPN.
  • Tue 11 Aug, 18:57 UTC. The Hacker News. Sandworm Group Uses Fake Job VPN to Hijack Devices.
  • Wed 12 Aug, 09:51 UTC. Infosecurity, its first report on the story. Sandworm hits Polish power plant via private APN, brief outage.
  • Thu 27 Aug, 20:46 UTC. dti.domaintools.com, its first report on the story. Leak shows Moscow university training cyber troops for Russia.
  • Thu 10 Sep, 10:30 UTC. SecurityWeek. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware. Cites a CVE in CISA KEV.
  • Mon 14 Sep, 16:00 UTC. SecurityOnline. Sophos Finds Cyclops Blink on Cisco Firewall Management Systems. This article, 18th of 20.
  • Mon 14 Sep, 22:16 UTC. Dark Reading. Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 12:00 UTC. The Hacker News. Sandworm Used Yggdrasil Network in Destructive Ukraine Wiper Attack.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 20 articles as a list
  1. Wed 29 OctDay 01
    1. Russian hackers, likely linked to Sandworm, exploit legitimate tools against Ukrainian targets15:50 · Security Affairs · First report

  2. Quiet for 3 days

    Sat 1 NovDay 31
    1. Sandworm APT Attacks Belarus Military With LNK Exploit and OpenSSH Over Tor obfs4 Backdoor12:46 · SecurityOnline · Picked up again

  3. Quiet for 6 days

    Fri 7 NovDay 91
    1. Sandworm Hackers Target Ukrainian Organizations With Data-Wiping Malware05:50 · GBHackers · Picked up again

  4. Quiet for 6 weeks

    Wed 17 DecDay 491
    1. Sandworm’s Tactical Pivot: Russian GRU Abandons Zero-Days to Weaponize Misconfigured Edge Devices03:50 · SecurityOnline · Picked up again

  5. Quiet for 5 weeks

    Sat 24 JanDay 871
    1. New DynoWiper Malware Used in Attempted Sandworm Attack on Polish Power Sector08:56 · The Hacker News · Picked up again

  6. Quiet for 2 days

    Mon 26 JanDay 893
    1. Russia-linked Sandworm APT implicated in major cyber attack on Poland’s power grid08:36 · Security Affairs
    2. Russian Sandworm Hackers Blamed for Cyberattack on Polish Power Grid09:10 · SecurityWeek
    3. Sandworm Blamed for Wiper Attack on Poland Power Grid22:11 · Dark Reading

  7. Quiet for 2 days

    Wed 28 JanDay 911
    1. Russian ELECTRUM Tied to December 2025 Cyber Attack on Polish Power Grid17:51 · The Hacker News

  8. Quiet for 23 weeks

    Thu 9 JulDay 2531
    1. Ukrainian Tax Firm Hit by Sandworm Warns Global Businesses15:07 · Dark Reading · Picked up again

  9. Quiet for 7 days

    Thu 16 JulDay 2601
    1. Sandworm uses CAPTCHAs to deliver FreakyPoll malware in Ukraine19:46 · Ars Technica · Picked up again

  10. Quiet for 3 days

    Sun 19 JulDay 2631
    1. UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware14:48 · The Hacker News · Picked up again

  11. Quiet for 3 weeks

    Mon 10 AugDay 2851
    1. Poland’s grid hit again by Sandworm via Fortinet VPN10:17 · SecurityWeek · Picked up again
  12. Tue 11 AugDay 2861
    1. Sandworm Group Uses Fake Job VPN to Hijack Devices18:57 · The Hacker News
  13. Wed 12 AugDay 2871
    1. Sandworm hits Polish power plant via private APN, brief outage09:51 · Infosecurity

  14. Quiet for 2 weeks

    Thu 27 AugDay 3021
    1. Leak shows Moscow university training cyber troops for Russia20:46 · dti.domaintools.com · Picked up again

  15. Quiet for 2 weeks

    Thu 10 SepDay 3161
    1. Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware10:30 · SecurityWeek · Exploited CVE · Picked up again · Known exploited CVE

  16. Quiet for 4 days

    Mon 14 SepDay 3202
    1. Sophos Finds Cyclops Blink on Cisco Firewall Management Systems16:00 · SecurityOnline · Picked up again · This article, 18th of 20
    2. Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink22:16 · Dark Reading · Known exploited CVE

  17. Quiet for 6 weeks

    Fri 23 OctDay 3591
    1. Sandworm Used Yggdrasil Network in Destructive Ukraine Wiper Attack12:00 · The Hacker News · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in