Threat Advisory: Cyclops Blink
Summary: Cisco Talos reported on Cyclops Blink, a modular Linux malware compiled for 32-bit PowerPC that has targeted small and home office devices since at least June 2019, with WatchGuard FireBox specifically listed as a target. The malware masquerades as a kernel process named 'kworker[0:1]', adjusts iptables to open hard-coded C2 ports, and uses four known modules for file transfer, system reconnaissance every 10 minutes, C2 server list updates, and persistence through the device's firmware update process.
Bottom line: The persistence module overwrites legitimate executables so the firmware update process itself reinstalls Cyclops Blink, meaning a standard firmware refresh may not clear an infected SOHO device.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026