"Eye" Spy: Cyclops Blink Returns With Extended Capabilities
Sophos, Friday, September 11th, 2026
Upgraded modular malware observed attacking Cisco Firewall Management Center devices.
Sophos X-Ops reports the return of Cyclops Blink with extended capabilities, observed in attacks against Cisco Firewall Management Center devices.
The malware is modular, meaning capability can be added after initial compromise without redeploying the implant, which complicates both detection and scoping during incident response.
Targeting the firewall management plane is the significant element: compromising the system that configures security policy is more valuable than compromising any single enforcement point, and these appliances typically carry limited endpoint visibility.