A cyber threat actor believed to be linked to Russia is leveraging vulnerabilities in Cisco's Firewall Management Center (FMC) technology to deploy an advanced malware known as Cyclops Blink. This malware is capable of credential harvesting, internal network scanning, and live traffic capture on compromised devices. Both Sophos and Cisco have identified it as a new iteration of Cyclops Blink, a botnet previously associated with Sandworm, a group tied to Russia's Main Intelligence Directorate. The attack utilizes two specific vulnerabilities in Cisco's Secure FMC software. The first, CVE-2026-20079, is a high-severity authentication bypass that allows unauthorized remote code execution and root access. The second, CVE-2026-20316, is a lower-severity flaw that permits low-privilege remote login, which can be escalated using older FMC vulnerabilities. Cisco has released hotfixes for these vulnerabilities and strongly recommends immediate application due to ongoing exploit activity. Cyclops Blink, which first emerged in 2022, initially targeted WatchGuard firewalls and ASUS devices, but has now evolved to run on 64-bit Linux systems. Its persistence and intelligence collection capabilities have been enhanced, making it a potent tool for reconnaissance and data theft. In addition to the Cyclops Blink campaign, two other threat clusters are also exploiting these Cisco vulnerabilities for malicious activities, including credential theft and ransomware distribution. Sophos attributes the new Cyclops Blink operation to actors with connections to Russia, although definitive evidence linking them to Sandworm remains elusive. Sandworm is notorious for its cyber espionage and disruptive attacks, including those against Ukraine's power grid and the NotPetya outbreak.