Sandworm Exploits Cisco Vulnerabilities to Deploy Upgraded Cyclops Blink Botnet

According to cybersecurity reporting, the Russian military intelligence group Sandworm has been actively chaining Cisco vulnerabilities to deploy an upgraded variant of the Cyclops Blink botnet. The malware, which was previously disrupted by the FBI in 2022, has been enhanced and is now being redistributed through compromised Cisco infrastructure. The campaign exploits known vulnerabilities in Cisco products to establish persistent remote access on targeted enterprise networks. The upgraded malware poses an enhanced threat due to its persistence mechanisms and ability to conduct network reconnaissance and lateral movement. While specific CVE numbers were not confirmed in the reporting, the exploitation is attributed to leveraging unpatched Cisco devices. The FBI's 2022 disruption of the original Cyclops Blink botnet is a confirmed historical event, and the current activity represents a reinvigoration of the threat by the same actor group. The global distribution of compromised devices and the potential for sustained network access underscore the significance of this campaign for enterprise security teams.