In August, researchers pulled a 64-bit Linux program called timezone_check off several compromised Cisco Firewall Management Center appliances. It is not a time zone utility. It is a rebuilt version of Cyclops Blink, the network-device malware Britain's National Cyber Security Centre took apart in 2022 and tied to Russian military intelligence.
The Counter Threat Unit research team at Sophos published its analysis on September 11, after Cisco described the campaign on September 9. Sophos assesses the implant is likely the work of the group it tracks as IRON VIKING, better known as Sandworm or Seashell Blizzard. We covered the Cisco end of that disclosure when Talos found three separate groups inside the same appliance. This is the first public look at what one of them left behind.
The 2022 version only fit one vendor
The samples the NCSC documented four years ago were built for WatchGuard hardware and stayed alive by modifying the vendor's own firmware. The 2026 build does neither. It runs on ordinary x86-64 Linux and persists through plain SysV init scripts, which means it will run on a far wider range of network-edge boxes than the original ever could.
The persistence itself is deliberately boring. The implant copies itself to /lib/tz/timezone_check, unlinks the file it was launched from, writes an init script at /etc/init.d/timezone_check, and links that into runlevels 2 through 5 as S89timezone_check. Every name is chosen to look like a time zone component. Sophos notes the code contains no privilege escalation step, so whoever ran it already had the access needed to write under /lib and /etc.
A search engine pointed at your traffic
The implant splits into a controller and five worker modules, each in its own process. One profiles the host, down to reading /etc/shadow where permissions allow. One transfers files and executes downloaded payloads, resolving hostnames through a DNS-over-HTTPS request to Google's public resolver at 8[.]8[.]8[.]8 on port 443, so those lookups never appear in the appliance's own DNS logs. One scans the internal networks the device can reach using raw packet sockets, working through a built-in port list that covers SSH, SMB, LDAP, SNMP, VPN and VMware management services.
The fifth is the one to sit with. It opens a raw packet socket, watches whatever traffic the device can see, and searches it for terms the operator supplies, compiling them into an Aho-Corasick matcher so it can hunt many strings at once. Only matching packets are retained and sent out. Sophos lists cleartext credentials, session cookies, authentication tokens and administrative commands among what an operator could collect this way. A firewall management console sits, by design, exactly where the management traffic is.
Where to look on an FMC box
Check for /lib/tz/timezone_check, an /etc/init.d/timezone_check script, and S89timezone_check symlinks under /etc/rc2.d through /etc/rc5.d. The controller disguises itself in process listings as [kworker/0:1], a name real kernel threads use. The analysed samples beacon once an hour over TLS to 89[.]34[.]96[.]56 on TCP port 43856 or 49172, and the implant inserts its own iptables ACCEPT rules for those two ports at startup, so an unexplained rule pair is itself a signal. Sophos says certificate validation is disabled on that connection, and the operator can push in up to 32 replacement command and control addresses at runtime, so blocking the one address is not a remedy.
The full Sophos Counter Threat Unit write-up carries the module-by-module breakdown and the controller's command codes. Our profile of the group is at Sandworm Team.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.