Cyclops Blink malware evolves to target x86-64 Linux systems

Key Takeaways

• Cyclops Blink malware has evolved into an x86-64 Linux implant, shifting from its previous PowerPC version.
• The updated malware targets Cisco Firewall Management Center (FMC) devices, leveraging their trusted position for deep network infiltration.
• New capabilities include packet sniffing, internal network scanning, and advanced persistence mechanisms.
• The implant uses a modular design with five child processes for various functions and communicates via custom TLS over outbound connections.
• Defenders should prioritize patching, restrict management access, and monitor for unusual outbound encrypted traffic.

The notorious Cyclops Blink malware has re-emerged with significant enhancements, now capable of infiltrating x86-64 Linux systems. This evolution allows attackers to gain extensive visibility and control within corporate networks, particularly through compromised Cisco Firewall Management Center (FMC) devices. The malware facilitates persistent remote access, deep traffic inspection, and comprehensive mapping of internal systems.

The targeting of network management appliances like Cisco FMCs is particularly alarming. These devices hold highly trusted positions within an IT infrastructure, and a breach at this level can expose critical configurations, sensitive credentials, and pathways to otherwise isolated internal systems. Gaining root access to such appliances, as has been reported in other incidents, can grant attackers virtually unfettered control over the network.

Sophos analysts first detected this new implant in August 2026 while investigating a malicious 64-bit Linux executable discovered on several compromised appliances. Their subsequent analysis firmly linked this new variant to Cyclops Blink, a modular malware family previously associated with the Russian-linked Sandworm APT group. However, Sophos has cautioned against definitive attribution for the 2026 deployments at this stage.

While the initial access vector in the analyzed incidents remains unconfirmed, Sophos noted in a report shared with Cyber Security News (CSN) that the affected environment had previously faced severe web-management risks. These included vulnerabilities such as the exploitation of embedded credentials, which could lead to unauthenticated access and be chained with other weaknesses to escalate control.

Cyclops Blink Evolves Into x86-64 Linux Implant

The latest iteration of Cyclops Blink represents a substantial architectural shift. Unlike its older PowerPC version, which was known for altering vendor firmware on WatchGuard devices, this new sample is a 64-bit x86-64 Linux executable. This change makes its persistence mechanism more portable across a broader range of compatible Linux appliances, as it now relies on standard SysV startup services rather than firmware modifications.

Upon successful compromise and with sufficient privileges, the implant relocates itself to a system directory. It then establishes persistence by registering a startup script, ensuring it automatically launches after system reboots. To evade detection, the malware disguises its controller process, making it appear as an ordinary Linux worker process (named kworker01), thereby blending into routine process listings and reducing the likelihood of casual discovery.

The malware’s architecture is highly modular, distributing its various functions across five distinct child-process modules. This design enables separate operations for reconnaissance, file exfiltration and transfer, network scanning, packet collection, and persistence. A central parent controller manages commands and maintains secure, encrypted communications, as detailed in the Cyclops Blink architecture diagram provided by Sophos.

This implant is designed for comprehensive host and network profiling. It gathers extensive details including operating system information, user accounts, running processes, storage configurations, network interfaces, and DNS resolver settings. If adequate permissions are obtained, it can also retrieve password hashes. Its versatile transfer component can exfiltrate any accessible files, download additional tools via HTTP or HTTPS, execute them, or even load Linux code directly into memory.

Such operational flexibility is particularly potent on a network management platform. A compromised device can serve as a multi-purpose hub for an attacker: an intelligence gathering point, a staging area for subsequent payloads, and a durable foothold with privileged access to management networks and multiple internal IP ranges. The command-and-control (C2) channel employs outbound TLS connections with a custom protocol, deviating from typical web traffic. Observed incidents showed hourly beaconing, though operators can dynamically adjust the server list and connection timing while the implant is active. This dynamic behavior complicates network blocking and incident response efforts, necessitating meticulous record-keeping of timing changes and destination IP addresses by defenders.

Scanning Turns Devices Into Sensors

One of Cyclops Blink’s new modules includes an internal network scanner. This component identifies locally connected IPv4 networks and probes either operator-specified ports or a pre-defined list that includes ports associated with administration, file sharing, messaging, directory services, web applications, network monitoring, VPNs, and virtualization. It can collect basic service responses and conduct web or TLS probing. This capability transforms an infected management appliance from a mere foothold into a powerful sensor, capable of discovering internal systems not exposed to the internet. This reconnaissance helps attackers select prime targets for lateral movement, a risk underscored by reports of root-level code execution on FMCs granting intruders broad control.

Furthermore, a dedicated capture module allows the malware to listen for raw Ethernet traffic visible to the host. It retains packets that match attacker-defined criteria. Configurable filters based on time, IP address, port, and content enable operators to selectively target valuable data such as credentials, cookies, authentication tokens, administrative commands, or sensitive application requests, rather than indiscriminately collecting all traffic.

What You Should Do

• Expand Threat Hunting: Organizations must extend their threat hunting efforts beyond initially identified devices. Examine all compatible Linux network appliances for the documented filesystem, process, network, and cryptographic indicators of compromise (IoCs).
• Apply Security Patches: Promptly apply all available security fixes for Cisco Firewall Management Center devices and other network appliances.
• Restrict Management Access: Implement stringent access controls for management interfaces. Utilize multi-factor authentication (MFA) and enforce the principle of least privilege.
• Review Outbound Encrypted Connections: Scrutinize all outbound encrypted connections for unusual patterns, especially those originating from network management devices. Cyclops Blink uses custom TLS over outbound connections, which may appear atypical.
• Investigate Unusual Services: Actively monitor for and investigate any unusual services or processes running on network appliances, particularly those attempting to mimic legitimate Linux worker processes like kworker01.
• Utilize Indicators of Compromise (IoCs): Leverage the provided IoCs in your security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and other threat intelligence platforms to detect and block malicious activity.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.