6 minhigh
“Eye” spy: Cyclops Blink returns with extended capabilities
Cyclops Blink malware resurfaced in 2026 targeting Cisco FMC devices with a Linux x86-64 implant featuring network scanning, packet capture, and SysV persistence, attributed to IRON VIKING. A 2026 variant of Cyclops Blink was found on compromised Cisco Firewall Management Center devices as a 64-bit Linux ELF named timezone_check. The modular implant uses five worker modules for host recon, file transfer, network scanning, packet capture, and SysV init persistence. It beacons hourly over TLS to 89.34.96.56 on ports 43856 or 49172.
Sens:▲ 24hConf:high
IOCs7
6file path1ip
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block outbound traffic to 89.34.96.56 on ports 43856 and 49172
- Hunt for /lib/tz/timezone_check and [kworker/0:1] processes on Linux appliances
- Inspect Cisco FMC devices for unauthorized /lib/tz/ directory and init scripts
Key Takeaways
- Implant masquerades as [kworker/0:1] process to blend into Linux process listings
- Module 0x0F uses DNS-over-HTTPS to 8.8.8.8:443 with a malformed User-Agent combining Firefox and Chrome tokens
- Module 0x11 scans 80+ ports including SSH, SMB, VPN, and VMware services via raw TCP SYN packets
- Module 0x12 captures raw Ethernet frames and filters by operator-defined search terms using Aho-Corasick matching
- Persistence uses SysV init at /etc/init.d/timezone_check with runlevel 2-5 symlinks, replacing 2022 WatchGuard firmware approach
Attack Chain
- Initial Access: Attacker deploys timezone_check ELF on compromised Cisco FMC devices with root privileges
- Persistence: Module 0x50 copies implant to /lib/tz/timezone_check and creates SysV init service
- Discovery: Module 0x08 collects host info, network config, users, processes, and /etc/shadow hashes
- Lateral Movement: Module 0x11 scans internal networks via raw TCP SYN on 80+ embedded ports
- Collection: Module 0x12 captures raw Ethernet frames filtering for operator-defined content patterns
- C2: Implant beacons hourly to 89.34.96.56 over TLS on ports 43856 or 49172
Affected Systems
- Cisco Firewall Management Center (FMC) devices
- x86-64 Linux-based network appliances
- SD-WAN controllers
- VPN concentrators
- Network orchestrators
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Linux EDR coverage varies across network appliances; process and file artifacts are visible if agents installed. |
| Network Visibility | Medium | TLS C2 on non-standard ports and DoH to 8.8.8.8 are visible in flow data. |
| Detection Difficulty | Moderate | Masquerading as kworker and timezone utility reduces casual discovery but file paths and C2 ports are distinctive. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Processes named [kworker/0:1] spawned from non-kernel parent processes indicate masquerading (T1036.004) | Process execution logs with parent-child relationships | Defense Evasion | Low — genuine kworker threads are kernel threads with no userspace parent |
| New SysV init scripts in /etc/init.d/ with rc2.d through rc5.d symlinks indicate persistence installation (T1037.004) | File integrity monitoring on /etc/init.d and rc directories | Persistence | Low — timezone_check service name is highly specific |
| Outbound TLS connections to ports 43856 or 49172 indicate Cyclops Blink C2 communication (T1571) | Network flow or firewall logs for non-standard port TLS | Command and Control | Low — these ports are not associated with standard services |
| AF_PACKET raw socket creation by non-network services indicates packet capture activity (T1040) | Audit logs for socket() syscalls with AF_PACKET type | Collection | Medium — legitimate network tools may use raw sockets |
Required Log Sources
- Linux process execution logs
- File integrity monitoring on /lib and /etc
- iptables rule modification logs
- Network flow data
- SysV init service creation events
- Raw socket creation audit logs
Key Behavioral Indicators
- Process named [kworker/0:1] with userspace parent process
- New directory /lib/tz/ containing executable timezone_check
- iptables OUTPUT ACCEPT rules for ports 43856 or 49172
- DoH POST to /dns-query with malformed Firefox-Chrome User-Agent
- HTTP GET with semicolons in Accept-Language and missing wildcard in Accept
- New SysV init script timezone_check with S89 prefix symlinks
Control Gaps
- Standard AV may not detect Linux ELF implants on network appliances
- Network firewalls may allow outbound TLS on non-standard ports
- SysV init service creation may not be monitored on network appliances
- DoH to 8.8.8.8 bypasses local DNS logging and filtering
- Raw socket creation may not be audited on appliance Linux systems
False Positive Assessment
Low — [kworker/0:1] process name with userspace parent, timezone_check init script, and C2 ports 43856/49172 are specific indicators unlikely to appear in legitimate configurations.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict outbound traffic from network appliances to required destinations only
- Enable file integrity monitoring on /lib and /etc of Linux network devices
- Alert on new SysV init scripts and iptables OUTPUT rule modifications
- Block or monitor DoH traffic to 8.8.8.8 from network management appliances
User Protection
- Restrict management access to network appliances via jump hosts with MFA
- Audit privileged accounts and SSH keys on network management infrastructure
- Apply vendor security advisories for Cisco FMC and similar appliances
Security Awareness
- Train network teams to verify legitimacy of timezone-related services on appliances
- Report unexpected iptables rule changes on network devices to security teams
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping20 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Credential Access
Tactic
Discovery
Tactic
Collection
Plain-Language Summary
A advanced hacking tool linked to Russian military intelligence was found on Cisco network management devices in August 2026. The tool, called Cyclops Blink, secretly installs itself to survive reboots and can scan internal networks, capture network traffic, steal files, and download additional malware. It disguises itself as a normal Linux background process. Organizations using Linux-based network appliances should check for the tool's files and block its communication address.
Additional IOCs
- File Paths:
/etc/init.d/timezone_check- SysV init script created for persistence/etc/rc2.d/S89timezone_check- Runlevel 2 startup symlink for persistence/etc/rc3.d/S89timezone_check- Runlevel 3 startup symlink for persistence/etc/rc4.d/S89timezone_check- Runlevel 4 startup symlink for persistence/etc/rc5.d/S89timezone_check- Runlevel 5 startup symlink for persistence/var/tmp/a.tmp- Fallback download path when no URL basename available
- Command Lines:
- Purpose: Add iptables ACCEPT rules for C2 ports in OUTPUT chain | Tools:
iptables,libiptc| Stage: Defense Evasion |iptables -A OUTPUT -p tcp --dport
- Purpose: Add iptables ACCEPT rules for C2 ports in OUTPUT chain | Tools:
- Other:
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Chrome/129.0.0- Malformed User-Agent combining Firefox and Chrome tokensLinux/Agnt-JG- Sophos detection signature for this threat
Showing defanged values
- file_path/etc/init.d/timezone_checkSysV init script created for persistence
- file_path/etc/rc2.d/S89timezone_checkRunlevel 2 startup symlink for persistence
- file_path/etc/rc3.d/S89timezone_checkRunlevel 3 startup symlink for persistence
- file_path/etc/rc4.d/S89timezone_checkRunlevel 4 startup symlink for persistence
- file_path/etc/rc5.d/S89timezone_checkRunlevel 5 startup symlink for persistence
- file_path/var/tmp/a.tmpFallback download path when no URL basename available
- ip89[.]34[.]96[.]56Hard-coded C2 server for Cyclops Blink implant