'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink

Vira Manti

Published Sep 15, 2026, 1:57 AM UTC

Source: SecuritySource
- Sandworm—the Kremlin's least subtle data terrorists—is back with an upgraded Cyclops Blink, chaining Cisco zero-days to build its botnet. Yes, the same one the FBI torched in 2022. Apparently "disrupted" just means "re-encrypted and reshipped." Routers, edge devices, and IoT—the threadbare hull of the internet—get conscripted into relay zombies. Who gets hurt: orgs treating edge gear like furniture. It isn't furniture; it's an open cargo bay. Patch your Cisco kit, rotate credentials, segment your network, and actually monitor outbound traffic. Assume anything that hasn't been patched since the last botnet obituary is already flagged. The FBI's PoD seal from 2022 expired—stop kidding yourself. Check the seals. Delivery signature applied.