Cyclops Blink Malware Returns, Now Targeting Cisco Firewall Management Devices

In August 2026, Sophos Counter Threat Unit researchers analysed a malicious 64-bit Linux program named timezone_check, found on multiple compromised Cisco Firewall Management Center (FMC) devices. Sophos says it is a variant of Cyclops Blink, malware the UK National Cyber Security Centre examined in 2022, and is likely linked to the Russia-based IRON VIKING group, also known as Sandworm and Seashell Blizzard. Cisco published details of the campaign on 9 September, which prompted Sophos to release its own analysis.

The 2022 samples focused on WatchGuard devices and relied on modifying vendor firmware. The 2026 version instead runs on standard x86-64 Linux and uses generic persistence methods. Sophos notes this broadens the range of network-edge appliances that could potentially be affected. The implant can discover devices and services on a network, monitor traffic through programmable packet surveillance, transfer files and run additional payloads. A compromised device could therefore be used for internal reconnaissance, intelligence collection and follow-on attacks.

The malware is modular, built around a parent controller and five worker modules that run as separate processes. The controller encrypts the data it collects and sends it to command and control servers. It also disguises itself with the name [kworker/0:1], imitating a normal Linux kernel process so it is less likely to be noticed in process lists. This article covers only the opening of the Sophos report, so further technical detail is not included here.