Cyclops Blink has resurfaced, offering attackers a more comprehensive view of corporate networks. However, the affected environment has faced serious web-management risks, including the exploitation of embedded credentials that allowed unauthenticated access and could be chained with other weaknesses to increase control. The malware divides tasks among five child-process modules, allowing reconnaissance, file movement, scanning, packet collection, and persistence to operate independently while a parent controller manages commands and secure communications.

An attacker could use one compromised device as a data collection point, a staging area for follow-up payloads, and a secure foothold with visibility into privileged management networks and multiple internal address ranges.

The scanner turns devices into sensors by identifying local IPv4 networks and testing selected ports or those on a linked administration, file sharing, messaging, directory services, web applications, network monitoring, VPNs, and virtualization lists. They must immediately apply available security patches, restrict management access, review outbound encrypted connections, and investigate unusual services following a Cisco firewall exploitation in reported attacks. Key indicators of compromise (IoCs):

  • **C2 IP address:** 89.34.96.56
  • **C2 TCP ports:** 43856, 49172
  • **File path:** /lib/tz/timezonecheck
  • **File name:** timezonecheck
  • **Init service:** /etc/init.d/timezonecheck
  • **Startup links:** /etc/rc2.d/S89timezonecheck, /etc/rc3.d/S89timezonecheck, /etc/rc4.d/S89timezonecheck, /etc/rc5.d/S89timezonecheck
  • **Process name:** kworker01
  • **User-Agent:** Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Chrome/129.0.0