Cyclops Blink Malware Targets Cisco Firewall Devices

• •Cyclops Blink malware targets Cisco FMC devices, providing persistent remote access.
• •The malware is linked to the Russian IRON VIKING threat group, enhancing its capabilities.
• •Cisco issued an advisory on September 9, 2026, detailing the malware's features and risks.

In August 2026, researchers from the Counter Threat Unit™ (CTU) discovered a malicious 64-bit Linux executable named timezone_check on compromised Cisco Firewall Management Center (FMC) devices. This malware variant, linked to the Russian IRON VIKING threat group, offers persistent remote access and advanced capabilities such as network discovery and packet surveillance. Cisco issued a public advisory on September 9, 2026, detailing the campaign. The Cyclops Blink malware is a modular framework that operates through a parent controller and multiple worker modules, enhancing its stealth and functionality. Unlike previous versions, this variant utilizes generic System V persistence, making it compatible with a broader range of devices. The malware's architecture allows for concurrent task execution and effective command and control operations. Organizations are advised to implement mitigation measures as the threat landscape evolves.