Sandworm, a Russian threat group, is exploiting a chain of Cisco vulnerabilities to deliver a refined version of the Cyclops Blink botnet, according to Dark Reading. The malware is the same family that the FBI disrupted in 2022, indicating the group has continued to develop it.
The report describes the campaign as spreading the botnet malware to target devices. The FBI's earlier disruption took down the previous version, but the new activity suggests Sandworm has adapted and resumed operations.
The development underscores the persistent threat from state-sponsored hackers who target network infrastructure. It also shows that a botnet the FBI thought it had dismantled can resurface in a more advanced form.