GoKawiilSandworm exploits two Cisco FMC bugs to deploy new Cyclops Blink malware
Security researchers at Sophos and Cisco report that a suspected Russian state actor, previously tied to the Sandworm group linked to Russia's GRU, is exploiting two vulnerabilities in Cisco's Secure Firewall Management Center software. The attackers chain a maximum-severity authentication bypass flaw with a lower-severity privilege escalation bug to install a reverse shell and then deploy an updated version of the Cyclops Blink implant, which can steal credentials, map internal networks, and intercept live traffic.
GoKawiil's interpretation of the reporting above, not reported fact.
Cyclops Blink has historically been used for long-term espionage and infrastructure disruption, so its reappearance on unpatched Cisco firewalls signals a renewed effort by state-linked hackers to establish persistent footholds in enterprise networks. Cisco's admission of active in-the-wild exploitation, paired with only interim hotfixes ahead of a full hardened release, leaves a window during which organizations relying on FMC remain exposed to a capable and stealthy adversary.
- Sandworm-linked actors are chaining CVE-2026-20079 and CVE-2026-20316 to compromise Cisco FMC devices.
- The attack deploys a new Cyclops Blink variant capable of credential theft, network scanning, and traffic capture.
- Cisco has issued hotfixes and urges immediate patching ahead of a fuller hardened release.
Source: darkreading.com — Jai Vijayan, 2026-09-14
Published there as: “'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.