4 Min LegereFons: ratpack223 per Getty ImagesActorem minaciorem Russicum verisimile malum software implantare, quod credentia colligere, retia interna explorare, et vivum trafficum in machinamentis compromissis capere potest, per coniunctionem duarum vulnerabilitatum in technologia Firewall Management Center (FMC) Cisco deployat.In relationibus separatis, Sophos et Cisco malware hoc ut novam versionem Cyclops Blink, modularis botnet et backdoor, quam agens gubernationis US et UK antea cum Sandworm, actore minaciore cum vinculis ad Directorate Principale Intelligentiae Russiae (GRU), coniunctam esse indicaverunt.Duae Separatae Vulnerabilitates Cisco FMCCisco Cyclops Blink actionem describit ut unam ex tribus separatis campanis, quae duas vulnerabilitates in software Secure FMC habet. Una vulnerabilitas est CVE-2026-20079, vulnerabilitas maximum gravitatem authenticationis bypass, quae sinit atacctorem remotum non authentificatum arbitrium codicis in machinamentis affectis exsequi et accessum radicis ad systema operativum subiacens obtinere. Secunda vulnerabilitas, quae ut CVE-2026-20316 notatur, est defectus inferioris gravitatis cum punctatione 5.3 CVSS, quae sinit atacctorem remotum cum privilegiis inferioribus log in et deinde alias priores vulnerabilitates FMC ad privilegia augenda uti.Relatum:Maximum Gravitas GitLab Defectus Supplecat Catenae in PericuloActores minaces fortasse ad Sandworm coniuncti duos defectus coniungunt ut primum instrumentum Netcat-basatum retro shell et proxy in systematibus FMC vulnerabilibus downloadent et deinde id ad novam variantem Cyclops Blink deployandam utantur.Cisco hotfixes pro utroque defectu hebdomade praeterita edidit et "fortiter suadent" organizationibus technologia affectata ut eas statim applicent, citans indicia activitatis exploit in mundo. Societas dixit se latam, firmam editionem cum emendationibus pro duobus novis defectibus et aliis internis vulnerabilitatibus in FMC postea hoc hebdomade edere. "Considerans abusus in mundo, vehementer suademus ut clientes hotfixes adnotatas quam primum applicent, pending editionem firmam," inquit Cisco.Cyclops Blink est malware quod primum in 2022 apparuit et initio firewall WatchGuard et, postea, machinas ASUS petivit. Eius functiones principales includebant informationem de machinamentis infectis ad servidores imperii et control (C2) beaconare, fasciculos malignos downloadare et exsequi, et nova modula ad suas facultates augendas addere.Malware per reboots et legitimas firmware updates persistere potuit, quod difficilem reddidit ad removendum. Tamen, FBI operationem iudicialiter auctoritatem ductam duxit, in qua machinamenta victimarum accessit, malware Cyclops Blink copiatum est, et deinde remota est.Un Significans Upgrade pro Cyclops BlinkNova variant, secundum Sophos, multum ex originalibus notis retinet dum plura nova addit. Maxima mutatio est quod malware nunc in systematibus 64-bit x86-64 Linux currit potius quam in vetere architectura 32-bit PowerPC adhibita a versione originali. Etiam technicas persistentiae Linux genericas adhibet pro firmware specifico venditoris modificando.Relatum:Actorem Minacem Generat 1M Emails Fraudulentos Personalizados in 3 DiebusNova variant Cyclops Blink addit activam retis explorandi et packet-capture facultates et suas functiones colligendi data ad includere hashes password, processum lineas mandati, informationem CPU, et data configurationis expandit. Hae mutationes Cyclops Blink potentia faciunt compatibile cum latiore ambitu machinum retis Linux-fundatarum et dant atacctores potentioris suggestum pro reconnaissance et collectione intelligentiae, inquit Sophos."Generica SysV persistentia in 2026 Cyclops Blink exemplaria dependentiam a firmware specifico WatchGuard removet, dum activa retis exploratio et selectiva packet captura substantialiter augent capacitatem intelligentiae-collectionis implantis," scripserunt investigatores Sophos. "Detectio in machinis Cisco FMC periculum ostendit quod a compromissis infrastructuris administrationis retis propositum est."Machinae retis compromissae et aliae machinae marginales atacctores praebere possunt prospectum privilegiatum in latiore ambitu et sinere eos trafficum observare, retis investigationes perficere, et ulteriores impetus inchoare, venditor notavit.Relatum:Papercut AI Swarm Impetus Novitates pro Cyber Kill ChainPraeter novam campaniam Cyclops Blink, duae aliae coetus activae sunt CVE-2026-20079 et CVE-2026-20316 explere. Prima cluster, quam Cisco Talos ut UAT 12197 sequitur, CVE-2026-20079 adhibet ad Web shells et instrumentum exsecutionis mandati Java ad credentia furanda plantanda. Altera cluster minax, UAT 11988, CVE-2026-20316 adhibet ad Qilin ransomware distribuendum.Sophos novam campaniam Cyclops Blink cum alta fiducia actoribus nexus Russiae attribuit et mediocrem fiduciam habet eam cum Sandworm coniunctam esse, quam venditor ut Iron Viking sequitur. "Inferior fiducia in attributione coetus minacis reflectit absentiam indiciorum conclusivorum directe coniungentium IRON VIKING ad observatas 2026 deployment," scripserunt investigatores.Sandworm est coetus hackorum a re publica Russica patrocinatus notus tam pro spionage quam pro operationibus cyber destructivis. Coetus ad aliquas ex maximis cyber impetibus decennii praeteriti coniunctus est, inclusis impetibus quae reticulum potentiae Ucrainae perturbaverunt et eruptionem NotPetya. Nuper, Sandworm usum vulnerabilitatum in infrastructura ad Internet faciem ad accessum ad organizationes in Ucraina et alibi ampliavit, dum continua ad incepta critica et alias organizationes strategice maximi momenti petens.
⚡ Renuntiatio
'Sandworm' Coniungit Vulnerabilitates Cisco ad Deployandum Cyclops Blink
Vulnerabilitates Relatae
CVE-2026-85706 - GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability - [Actively Exploited]
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
CVE-2026-20316 - Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability - [Actively Exploited]
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.
This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.
Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.
CVE-2026-20079 - Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability - [Actively Exploited]
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.