Sandworm

Sandworm Exploits Cisco Vulnerabilities to Deploy Upgraded Cyclops Blink Botnet

The Russian threat actor Sandworm has been observed chaining known Cisco vulnerabilities to deploy an upgraded version of the Cyclops Blink botnet, according to recent intelligence reporting. The malware, originally disrupted by the FBI in 2022, has been enhanced and is being redistributed through compromised infrastructure. The campaign targets enterprise network devices, leveraging unpatched vulnerabilities to maintain persistent remote access and facilitate lateral movement within victim networks.