Sandworm-Linked Operators Chain Cisco FMC Flaws to Deploy New Cyclops Blink

A likely Russian state-linked threat actor is exploiting two Cisco Secure Firewall Management Center vulnerabilities to install an expanded version of the Cyclops Blink backdoor.

The intrusion chain combines a critical authentication bypass, CVE-2026-20079, with a static-credential flaw, CVE-2026-20316. Attackers gain access to vulnerable FMC systems, deploy a Netcat-based reverse shell and proxy, and then install the new malware variant.

Sophos assessed with high confidence that the operators have a Russian nexus. It attributed the activity to Sandworm, which it tracks as Iron Viking, with moderate confidence because investigators found no conclusive evidence directly linking the observed deployments to that group.

The exact start date and full scope of the campaign are not known. However, both vulnerabilities are under active exploitation and have been added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog.

Two FMC vulnerabilities provide the entry point

Cisco Secure Firewall Management Center is valuable to attackers because it occupies a trusted position in network-management infrastructure. Compromising the platform can provide visibility into traffic, configurations, credentials, and systems behind the network perimeter.

The two exploited vulnerabilities have substantially different severity scores and immediate effects:

Vulnerability	Affected versions	Technical impact	CVSS
CVE-2026-20079	Cisco Secure Firewall Management Center 7.0.0	Unauthenticated authentication bypass leading to script or command execution and potential root access	10
CVE-2026-20316	Cisco Secure Firewall Management Center 7.0.9 and earlier	Static credentials allow unauthenticated access through a low-privileged account and exposure of sensitive data	5.3

CVE-2026-20079 exists in the FMC web interface and results from an incorrectly configured system process created during boot. A remote attacker can send crafted HTTP requests without first authenticating. Successful exploitation permits script and command execution with enough privilege to obtain root access to the underlying operating system.

Its CVSS vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, reflects remote exploitation, low attack complexity, no required privileges or user interaction, and high impact across confidentiality, integrity, and availability. It is classified as CWE-288, authentication bypass through an alternate path or channel.

CVE-2026-20316 has a narrower direct impact. The FMC interface assigns static credentials to a low-privileged account, allowing a remote attacker to authenticate without possessing legitimate user credentials. The immediate result is access to sensitive information available to that account.

Cisco has also warned that attackers can combine this access with previously known FMC vulnerabilities to escalate privileges. Its vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, and the weakness is classified as CWE-259, use of a hard-coded password.

The lower 5.3 score does not indicate low operational risk. CVE-2026-20316 is actively exploited and has also been used in ransomware campaigns.

Cyclops Blink moves beyond its original appliance targets

After exploiting the FMC installation, the suspected Sandworm-linked operators deploy a Netcat-based reverse shell and proxy tool. This intermediate tooling gives them an interactive channel and helps prepare the system for installation of Cyclops Blink.

Cyclops Blink is a modular botnet and backdoor previously associated with Sandworm by US and UK government agencies. The malware first appeared in 2022, initially compromising WatchGuard firewalls and later ASUS devices.

Previous versions could report infected-device details to command-and-control infrastructure, download and execute files, and load additional modules. They were also designed to remain present after reboots and legitimate firmware updates.

The newly identified variant represents a significant redesign. It runs on 64-bit x86-64 Linux instead of the earlier 32-bit PowerPC architecture and no longer depends on WatchGuard-specific firmware modifications for persistence.

Instead, it uses generic SysV persistence mechanisms available across a broader range of Linux systems. That change potentially makes the implant usable against Linux-based network appliances beyond the products targeted in earlier campaigns.

The new version can also:

• Scan internal networks for additional systems.
• Selectively capture live network packets.
• Collect password hashes.
• Record process command lines.
• Gather CPU and system-configuration information.
• Maintain command-and-control beaconing.
• Download and execute additional payloads.
• Load modules that extend its capabilities.

These functions turn a compromised management appliance into more than a durable backdoor. The attacker can use it as a reconnaissance platform, traffic-collection point, credential source, and staging system for movement deeper into the network.

Sandworm attribution remains qualified

Sophos attributed the campaign to Russia-nexus operators with high confidence but assigned only moderate confidence to the specific Sandworm connection. The distinction matters: investigators recognized Cyclops Blink and infrastructure behavior associated with Russian operations, but did not identify definitive evidence tying these particular compromises to Iron Viking.

Sandworm has previously been linked to espionage and destructive attacks, including disruptions of Ukraine’s power grid and the NotPetya outbreak. The group has also targeted Internet-facing infrastructure and strategically important organizations.

The malware connection strengthens the assessment, but it does not prove that every Cyclops Blink deployment is controlled by the same operator. The reported Cisco FMC campaign should therefore be treated as likely Sandworm-linked rather than conclusively attributed.

Cisco Talos has identified two other activity clusters exploiting the same vulnerabilities for different objectives. There is no established evidence that all three campaigns share an operator.

UAT 12197 exploits CVE-2026-20079 to install Web shells and a Java-based command-execution tool, with credential theft among its goals. UAT 11988 uses CVE-2026-20316 to distribute Qilin ransomware.

The flaws are consequently supporting state-linked intrusion activity, credential theft, persistent remote access, and financially motivated ransomware deployment.

CISA deadlines have already passed

CISA added CVE-2026-20316 to its KEV catalog on July 29, 2026, with an August 1, 2026 remediation deadline for US federal civilian agencies. The catalog records its use in ransomware campaigns.

CVE-2026-20079 entered the KEV catalog on September 9, 2026. Its federal remediation deadline was September 12, 2026.

CISA requires agencies to apply vendor mitigations while complying with BOD 26-04, “Prioritizing Security Updates Based on Risk,” and its Forensics Triage Requirements. Organizations must also assess each asset’s Internet exposure. For affected cloud services, agencies must follow the applicable BOD 26-04 guidance or stop using the product when mitigations are unavailable.

The entries are part of a wider series of recently exploited Cisco flaws. Other Cisco vulnerabilities added to KEV during the preceding 90 days include CVE-2026-20349 on August 11, 2026, CVE-2008-4128 on July 13, 2026, and CVE-2026-20230 on June 25, 2026.

Hotfixing must be paired with forensic investigation

Cisco has released hotfixes for both FMC vulnerabilities and urged customers to install them immediately. The company also plans a broader hardened release covering these issues and additional internally discovered FMC vulnerabilities. A release date has not been disclosed.

Administrators should inventory all FMC deployments, particularly version 7.0.0 and installations running 7.0.9 or earlier. They should then apply Cisco’s hotfixes and install the hardened release when it becomes available.

Remediation alone cannot establish that a system was not previously compromised. Security teams should examine FMC hosts and surrounding network telemetry for:

• Unauthorized Web shells.
• Netcat reverse shells or unexpected proxy activity.
• Unrecognized Java command-execution components.
• Suspicious SysV startup entries or services.
• Internal scanning originating from an FMC appliance.
• Selective packet-capture activity.
• Access to password hashes or sensitive configuration data.
• Anomalous outbound connections and command-and-control beaconing.
• Unexpected process command lines or downloaded executables.
• Evidence of credential theft or subsequent lateral movement.

No specific file hashes, domains, or IP addresses are publicly identified in the available reporting. Defenders must therefore combine vendor-provided indicators with behavioral hunting and forensic review.

Any Internet-accessible FMC system within the affected version ranges should be treated as a priority investigation target. Where evidence of compromise is found, responders should assume that credentials and traffic visible to the appliance may have been exposed and expand the investigation into the networks it manages.