Cyclops Blink resurfaces on Cisco firewall managers as portable x86-64 Linux malware

Cyclops Blink is a modular framework built around a parent controller and five child-process worker modules, with each module running as its own process so tasks execute concurrently and one module's failure does not take down the others ^[8]. The controller opens a dedicated inter-process channel for each module, routes inbound commands by module identifier, collects the output, applies cryptographic protection, and forwards the records to command-and-control servers ^[9].

The controller runs under the name [kworker/0:1], mimicking the genuine kernel worker threads common on Linux hosts ^[10]. During initialization it adds ACCEPT rules to the iptables OUTPUT chain for TCP ports 43856 and 49172, the two ports it uses for C2, and removes them when it shuts down or restarts ^[11]. It edits the filter table directly through the linked libiptc interface and only falls back to the system iptables utility if that fails ^[12].

A fixed-size status structure keeps the workers synchronized. The controller pushes each one the active C2 IPv4 list, the beacon interval, the time until the next beacon, outbound queue data, and the relevant process IDs ^[13].

The five workers cover host reconnaissance, file transfer and payload execution, active network discovery, selective packet capture, and persistence ^[14]. Module 0x08 handles the host profiling: operating system, kernel, hostname and uptime; processor, memory, filesystem and storage; local users, groups, processes and command lines; and network interfaces, ARP tables and resolver configuration ^[15].