Cyclops BlinkMalware
Cyclops Blink is a modular malware that has been used in widespread campaigns by Sandworm Team since at least 2019 to target Small/Home Office (SOHO) network devices, including WatchGuard and Asus. Cyclops Blink is assessed to be a replacement for VPNFilter, a similar platform targeting network devices.From MITRE ATT&CK
Last reported 11 days ago, by Recorded Future5 reports
ATT&CK techniques
1 technique · each with the sentence it comes from- T1505.003Web Shell
“The first cluster which we track as UAT-12197, involves the exploitation of CVE-2026-20079, leading to the deployment of web shells, a Java Archive (JAR)-based command executor, and credential exfiltration.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
September 2026 CVE Landscape“…UNC3569 to GhostContainer and GRAYRABBIT deployments, while Cisco FMC exploitation by three threat clusters led to credential theft, Cyclops Blink deployment, and Qilin ransomware.”
-
'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink“'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink”
-
“Eye” spy: Cyclops Blink returns with extended capabilities““Eye” spy: Cyclops Blink returns with extended capabilities”
-
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities“…eading to the deployment of a Netcat-based reverse shell and proxy tooling, ultimately leading to the deployment of a variant of the Cyclops Blink malware, previously attributed to the Russian APT Sandworm by the United States and United Kingdom.”
-
“We find many things that others do not even see”“On February 23, the UK National Cyber Security Centre published a study on a new backdoor called Cyclops Blink.”
Indicators in its reports
named in the reports above- 89.34.96[.]56in 2 reports
- 208.123.119[.]215in 1 report
- b037f45e02a28932…4eb2acbef77din 1 report
- db491181ece3f319…d8cc7a1a8c8ein 1 report
- 104.218.165[.]253in 1 report
- 91.214.78[.]118in 1 report
- 6f98add5d1a77291…bd8e3d2fe461in 1 report
- 43.204.2[.]142in 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.