Sandworm Strikes the Heart of Cisco Firewalls with 64-bit Cyclops Blink

On September 9, 2026, Cisco Talos disclosed an active intrusion campaign against Cisco Secure Firewall Management Center (FMC), the centralized management console for enterprise firewall and VPN policies. Three distinct attack clusters are exploiting two FMC software vulnerabilities: the most dangerous, attributed with high confidence to the GRU-linked Sandworm actor (Unit 74455), deploys a new 64-bit variant of the Cyclops Blink malware equipped with network scanning and selective packet capture capabilities. The novelty lies not in the individual exploit, but in the conversion of the network security governance tool into an intelligence collection platform.

The Two CVEs That Open the Management Plane

The attack chain documented by Cisco Talos exploits CVE-2026-20079 and CVE-2026-20316, both in Cisco Secure FMC software. The first, with a CVSS score of 10.0 — the maximum on the scale — is an authentication bypass that allows an unauthenticated remote attacker to execute scripts with root privileges. The second, CVSS 5.3, exposes static credentials that permit limited-privilege access, chainable with other vulnerabilities for escalation.

The two flaws are not equivalent in severity, but they are complementary in offensive practice. CVE-2026-20079 provides immediate entry into the management plane; CVE-2026-20316 offers an alternative or stabilization path for access. The National Vulnerability Database confirms affected product versions through associated CPE records. CISA has added CVE-2026-20079 to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of September 12, 2026.

UAT-11823: Techniques, Persistence, and Attribution

In the UAT-11823 cluster, Talos researchers observed the use of a Makeself package disguised as a license.tmp file. The actor updates the file on disk with a malicious copy that, executed via the package_info.pl utility with root privileges, establishes a Netcat-based reverse shell. From there, the deployment of Cyclops Blink proceeds.

The implant masquerades as timezone_check, a name that mimics legitimate Linux kernel worker threads [kworker/0:1]. Persistence files are placed in /lib/tz/timezone_check and /etc/init.d/timezone_check, with SysV links for runlevels 2-5. This generic persistence mechanism replaces the previous approach, which was tied to proprietary WatchGuard firmware.

Attribution to Sandworm carries two confidence levels. Cisco Talos notes that "UAT-11823 overlaps in tooling with the Sandworm APT actor," with high confidence in the infrastructural link. Sophos, which tracks the group as Iron Viking, confirms high confidence in the link to Russian-origin actors, but moderate confidence in the specific link to Sandworm: "The lower confidence in the threat group attribution reflects the absence of conclusive evidence directly linking IRON VIKING to the observed 2026 deployments."

The Two Modules That Turn the Firewall Into Internal Probes

The 2026 Cyclops Blink variant introduces two functional modules not documented in previous versions. Module 0x11 scans locally connected IPv4 networks, using raw sockets to send SYN packets toward actor-specified ranges or an embedded port list. Module 0x12 opens an AF_PACKET socket to capture visible Ethernet frames, applying Aho-Corasick pattern matching to filter traffic of interest.

Communications with the command-and-control server use the hard-coded IP address 89.34.96.56 on TCP ports 43856 and 49172. The malware establishes TLS sessions without conventional certificate validation, then exchanges data through a custom non-HTTP protocol. The implant also modifies the iptables OUTPUT chain rules to accept its own C2 traffic.

"Generic SysV persistence in the 2026 Cyclops Blink samples removes the dependency on WatchGuard-specific firmware, while active network scanning and selective packet capture substantially expand the implant's intelligence-collection capabilities" — Sophos researchers, via Dark Reading

The Architectural Reversal: From Guardian to Insider

The Cisco FMC is designed as a consolidation point for security policies: from here, administrators define firewall rules, VPNs, access control, and traffic inspection. Compromising this node does not simply mean breaching a server; it means gaining a privileged view of the entire network topology. The addition of scanning and capture modules transforms the management plane from a strategic target into an operational collection platform: the firewall becomes an internal probe, with visibility into network segments normally separated by perimeter controls.

The adoption of the 64-bit x86-64 architecture indicates a deliberate abstraction from the specific target. The original Cyclops Blink, discovered in 2022, was bound to WatchGuard device firmware. The removal of this dependency suggests intentional portability: the implant can adapt to any Linux-based appliance in the network device landscape, expanding the future deployment surface.

What to Do Now

• Apply the hotfixes released by Cisco for affected Secure FMC versions, pending the full hardening release scheduled for the week of September 14, 2026.
• Perform forensic triage on FMC systems for timezone_check files in /lib/tz/ and /etc/init.d/, anomalous iptables rules on ports 43856 and 49172, and TLS connections to 89.34.96.56.
• Isolate the FMC management plane from the production network and unnecessary Internet access, treating it as a critical control plane with dedicated access controls.
• Verify compliance with CISA Binding Operational Directive 26-04 for U.S. federal organizations, with a deadline of September 12, 2026.

Parallel Clusters and the Risk of Overlap

Beyond UAT-11823, Talos documented two additional active clusters on the same FMC flaws. UAT-12197 uses web shells for credential theft; UAT-11988, affiliated with the Qilin ransomware, exploits the vulnerabilities for initial access to target networks. The sharing of the same attack surface by actors with distinct objectives — strategic espionage versus criminal monetization — introduces a risk of operational overlap: the same compromise can be resold, reused, or contested among different groups, complicating incident response.

Exposure estimates indicate between approximately 300 and 700 internet-reachable Cisco Secure FMC instances, according to Censys and FOFA scan data reported by Tech Insider. The range reflects detection uncertainties: some installations may be protected by VPNs or placed behind bastion hosts, reducing visibility to public scanners.

The dossier does not specify whether the scanning and capture modules were actively used in the observed intrusions or represent latent capabilities. It is also unknown whether Sandworm independently discovered CVE-2026-20079 — publicly disclosed in March 2026 — or acquired details through other channels. The first documented exploitation dates to August 2026, with an exposure window of months.

The evolution of Cyclops Blink signals a broader transformation in the posture of state actors toward network security infrastructure. No longer implants on individual perimeter devices, but centralized management platforms as end-to-end listening posts. The management plane, designed to see everything, becomes the blind spot that makes it possible.

Sources

• https://www.darkreading.com/cyberattacks-data-breaches/sandworm-chains-cisco-vulnerabilities-cyclops-blink
• https://thehackernews.com/2026/09/russian-state-sponsored-hackers-use.html
• https://gbhackers.com/cyclops-blink-variant/
• https://blog.talosintelligence.com/fmc-ongoing-exploitation/
• https://forkast.news/three-threat-actor-clusters-including-sandworm-are-actively-exploiting-cisco-fmcs-cvss-10-0-authentication-bypass/
• https://www.bankinfosecurity.com/cisco-firewall-bugs-let-in-sandworm-qilin-a-32793
• https://tech-insider.org/cisco-fmc-cve-2026-20079-sandworm-qilin-2026/
• https://nvd.nist.gov/vuln/detail/CVE-2026-20079
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog