Google\\Brave AI search 10/8/2026
UAT-11823
UAT-11823 is an espionage-oriented Advanced Persistent Threat (APT) cluster heavily linked by Cisco Talos to the notorious Russian state-sponsored military intelligence group Sandworm (GRU Unit 74455, linked to Russia\'s GRU military intelligence).
Unlike its cybercriminal counterpart, UAT-11988 (which focuses on deploying Qilin ransomware for extortion), UAT-11823 operates purely as a state-linked cyber espionage cell. Its objective centers on long-term data collection, intelligence gathering, and persistent network access.
First publicly detailed on September 10, 2026, UAT-11823 is one of three exploitation clusters targeting Cisco Secure Firewall Management Center (FMC) systems.
Key facts:
* Vulnerabilities exploited: CVE-2026-20079 (CVSS 10.0, unauthenticated auth bypass → root) and CVE-2026-20316 (low-privilege remote login)
* Techniques: Trojanized license.tmp file processed via the legitimate package_info.pl utility to establish Netcat-based reverse shells; bash scripts to harvest managed-device configurations for exfiltration
* Malware deployed: A variant of Cyclops Blink, a modular ELF implant previously attributed to Sandworm, providing persistence, credential harvesting, arbitrary command execution, network scanning, and packet sniffing
* Objective: Espionage-oriented persistent access and configuration exfiltration across managed firewalls
Talos published Snort detection rules (signatures 66075–66080 for CVE-2026-20079, 66883 for the license.tmp manipulation technique) and noted that patching alone does not remove backdoors already planted on compromised FMC instances.
Target Strategy and Methodology
In the high-profile exploit campaign targeting network edge security, UAT-11823 systematically subverts edge architecture:
• Vulnerability Exploitation: The group chains two separate vulnerabilities in the Cisco Secure Firewall Management Center (FMC): the maximum-severity authentication bypass (CVE-2026-20079) and static/hardcoded low-privilege credentials (CVE-2026-20316).
• Root Level Execution: They abuse legitimate FMC package-management systems to run automated malicious scripts as root.
• Information Gathering: Once inside, UAT-11823 targets configuration settings, system properties, and architecture data from every single managed device controlled by the compromised FMC appliance.
• The Payload (Cyclops Blink): To preserve permanent access inside the core network segment, they drop a Netcat-based reverse shell alongside a custom variant of Cyclops Blink.
The Tooling Connection
The definitive attribution linking UAT-11823 back to Sandworm rests on the deployment of this Cyclops Blink payload. Cyclops Blink is a modular, advanced Linux-based backdoor specifically engineered by Russian state actors to target high-value network perimeter and firewall devices. The variant used by UAT-11823 boasts complex capabilities, including:
• DNS-over-HTTPS resolution to mask Command and Control (C2) traffic.
• Silent file system administration and hidden data exfiltration.
• Passive packet sniffing, internal network scanning, and localized credential harvesting.
The authoritative Indicators of Compromise (IoCs) published by Cisco Talos for the UAT-11823 Sandworm-linked cluster, along with targeted detection rules, are detailed below.
1. Network Indicators (Firewall Blocklist IPs)
These IP addresses were utilized by UAT-11823 for vulnerability scanning, command execution, and maintaining reverse shell connections back to their command-and-control (C2) server infrastructure:
• 208.123.119[.]215 – Active Netcat-based reverse shell destination port 3090
• 89.34.96[.]56 – Netcat reverse shell / Cyclops Blink primary C2 handler
• 91.214.78[.]118 – Secondary operational C2 server infrastructure
• 104.218.165[.]253 – I nbound vulnerability scanning and payload staging server
**(Note: While 43.204.2[.]142 is also found in this overall campaign, it belongs exclusively to the UAT-11988 Qilin ransomware affiliate cluster).
2. Host & Malware Indicators (SHA-256 Hashes)
• 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461
• Description: Linux-based Cyclops Blink backdoor variant payload deployed persistently on the compromised Linux appliance subsystem.
3. Targeted SIEM Query (Splunk SPL)
This focused query detects network egress to the UAT-11823 C2 addresses, execution strings matching their unique FIFO Netcat reverse shell syntax, and the exploitation of the legitimate package-checking tool to invoke the threat actor\'s payload:
***SPL CODE IS AVAILABLE HOWEVER THERE IS A WARNING TO USE WITH CAUTION AND WILL NOT COPY OVER TO THIS DOCUMENT.***
4. Behavioral Hunting Checklist
If reviewing Linux audit logs or appliance commands directly, investigate the immediate appearance of:
1. Named Pipe creation: Use of code has warning begins with mkfifo in a long string that is executed via the shell.
2. Abuse of Makeself: Deployed compressed package modifications to overwrite on-disk paths under /var/tmp/license.tmp.
3. Root Privileges: Execution anomalies running through Cisco\'s administrative script utility package_info.pl invoking non-standard shell subprocesses as root.
The comprehensive and evolving list of multi-cluster elements can be directly cross-referenced via the Cisco Talos IOCs Github Repository.
UAT-11823 stands out from the other APT actors in several key ways:
Motivation: Espionage over destruction or extortion
While Sandworm (APT44) is primarily known for destructive operations — wipers, power-grid sabotage, NotPetya — UAT-11823\'s observed activity is purely espionage-oriented: persistent access and silent configuration exfiltration. It shares Sandworm\'s tooling (Cyclops Blink) but pursues a quieter, intelligence-gathering objective rather than physical-world disruption. This makes it more akin to APT28 (Cozy Bear), another GRU unit, in its mission profile, despite the shared malware.
Target: Security management infrastructure as a force multiplier
Most APTs target edge devices, VPNs, or OT/ICS systems. UAT-11823 specifically targets Cisco FMC — the management plane for firewalls — giving it visibility into and control over an entire fleet of managed security devices from a single compromised box. This is a higher-leverage target than a typical edge appliance.
Technique: Legitimate-tool abuse for code execution
The use of FMC\'s own package_info.pl utility to execute a trojanized license.tmp file is a distinctive living-off-the-land technique. Most APTs rely on web shells, JAR droppers, or direct binary drops (as the other two clusters did). This makes detection harder because the execution path uses a legitimate system process.
C2: Simple Netcat reverse shells
Rather than the more sophisticated C2 frameworks common among APTs (GossipFlow, TeleBot, domain-fronted HTTPS), UAT-11823 used Netcat-based reverse shells to its C2 infrastructure — a lower-fidelity but harder-to-attribute approach that fits Sandworm\'s preference for simplicity and deniability.
Comparison to the other FMC clusters:
UAT-11823 UAT-12197 UAT-11988
Motivation Espionage Credential theft / opportunistic Ransomware (Qilin)
CVEs Both (20079 + 20316) 20079 only 20316 only
Payload Cyclops Blink ELF implant JSP web shell + JAR LOTL → Qilin ransomware
Objective Persistent access + config exfil Steal stored credentials Encrypt + exfiltrate for extortion
In short, UAT-11823 is the most consequential of the three from a national-security standpoint — a state-actor using a known Sandworm implant to quietly harvest firewall configurations across managed networks, with no destructive or financial endgame.
Cisco Talos published a set of IOCs in their blog post and maintains an IOC repository on GitHub. Here\'s what\'s been publicly identified for UAT-11823:
IP Addresses
IP Role
89.34.96[.]56 NetCat-based reverse shell C2
208.123.119[.]215 NetCat-based reverse shell C2
91.214.78[.]118 NetCat-based reverse shell C2
104.218.165[.]253 Attacker\'s vulnerability scanner for CVE-2026-20079
File Hash
SHA-256 Description
6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461 Cyclops Blink malware variant
Domains
No specific C2 or staging domains were published in the public reporting — the actor used raw IP-based Netcat reverse shells and DNS-over-HTTPS for IP resolution (a Cyclops Blink capability), which makes domain-based detection less applicable here.
Behavioral / Log-Based Indicators
These are arguably more useful than the atomic IOCs above:
* FMC syslog: Any reference to /var/tmp/license.tmp in expert-mode logs is a strong indicator of exploitation (both UAT-11823 and UAT-11988 used this path)
* Snort signatures: 66075–66080 for CVE-2026-20079 exploitation, 66883 for the license.tmp manipulation technique.
* Filesystem: Unexpected scripts in /etc/init.d/ (Cyclops Blink persistence), Netcat processes, or a Makeself archive where license.tmp should be.
Caveats
* These are leads for retrospective investigation, not a complete blocklist. Talos explicitly notes that additional indicators are available through their IOC repository and that the listed indicators may no longer be operational.
* Patching does not remove already-planted backdoors — the reverse shell and Cyclops Blink implant were written directly to the filesystem, so a compromised FMC must be rebuilt, not just patched.
The Threat Codex
(https://threatcodex.com/index.php?search=UAT-11988)
UAT-11823
Threat Actor
Description-
A Russian state backed threat actor associated with the Main Intelligence Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).
Other Names-
Sandworm (Trend Micro)
APT44 (Mandiant)
Iron Viking (SecureWorks)
Voodoo Bear (CrowdStrike)
FROZENBARENTS (Google)
Seashell Blizzard (Microsoft)
DEV-0960 (Microsoft)
UAT-11823 (Cisco)
UAC-0125
UAC-0165
CyberArmyofRussia
IRIDIUM (Microsoft)
UAC-0113 (Google)
BE2 (Kaspersky)
ATK 14 (Thales)
TEMP.Noble (FireEye)
Quedagh (F-Secure)
CTG-7263 (SecureWorks)
DEV-0674 (Microsoft)
Last Active- 2026-09-15
Malware & Tools Used-
CaddyWiper
Cobalt Strike
Cyclops Blink
DCRat
DynoWiper
Impacket
Industroyer2
Kapeka
Metasploit
Mimikatz
NikoWiper
Prestige ranusomeware
reGeorg
WAVESIGN
Exploited Services-
Telegram
Zoom
Exploited Vulnerabilities-
CVE-2026-20316
CVE-2026-20079
CVE-2025-8088
CVE-2024-1709
CVE-2023-48788
CVE-2023-42793
CVE-2023-38831
CVE-2023-32315
CVE-2023-23397
CVE-2022-41352
CVE-2021-34473
Recent Publications-
2026-09-11 “Eye” spy: Cyclops Blink returns with extended capabilities-
https://www.sophos.com/en-gb/blog/-eye-spy-cyclops-blink-returns-with-extended-capabilities
2026-09-09 Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
https://blog.talosintelligence.com/fmc-ongoing-exploitation/
2026-08-11 Sandworm hackers target IT pros with trojanized WireGuard VPN client
https://www.bleepingcomputer.com/news/security/sandworm-hackers-target-it-pros-with-trojanized-wireguard-vpn-client/
2026-07-23 Hackers abuse Notepad++ plugins to stealthily install malware
https://www.bleepingcomputer.com/news/security/hackers-abuse-notepad-plus-plus-plugins-to-stealthily-install-malware/
2026-02-10 Beyond the Battlefield: Threats to the Defense Industrial Base
https://cloud.google.com/blog/topics/threat-intelligence/threats-to-defense-industrial-base
2026-01-27 Diverse Threat Actors Exploiting Critical WinRAR Vulnerability CVE-2025-8088
https://cloud.google.com/blog/topics/threat-intelligence/exploiting-critical-winrar-vulnerability
2026-01-23 ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025
https://www.welivesecurity.com/en/eset-research/eset-research-sandworm-cyberattack-poland-power-grid-late-2025/
2025-02-12 The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation
https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/
2024-12-18 UAC-0125 Attack Detection: Hackers Use Fake Websites on Cloudflare Workers to Exploit the “Army+” Application
https://socprime.com/blog/uac-0125-attacks-against-ukraine-detection/
2024-09-22 The Russian APT Tool Matrix
https://blog.bushidotoken.net/2024/09/the-russian-apt-tool-matrix.html
2024-04-17 Kapeka: A novel backdoor spotted in Eastern Europe
https://labs.withsecure.com/publications/kapeka
2023-10-18 Government-backed actors exploiting WinRAR vulnerability
https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/
2023-08-08 Cyber Operation of Russian Intelligence Services as a Component of Confrontation on the Battlefield
https://ssu.gov.ua/uploads/files/DKIB/technical-report.pdf
2023-04-19 Ukraine remains Russia’s biggest cyber focus in 2023
https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/
2023-01-31 New Report Reveals NikoWiper Malware That Targeted Ukraine Energy Sector
https://thehackernews.com/2023/01/new-report-reveals-nikowiper-malware.html
2022-11-28 RansomBoggs: New ransomware targeting Ukraine
https://www.welivesecurity.com/2022/11/28/ransomboggs-new-ransomware-ukraine/
2022-10-14 New “Prestige” ransomware impacts organizations in Ukraine and Poland
https://www.microsoft.com/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
2022-08-16 Overview of the Cyber Weapons Used in the Ukraine - Russia War https://www.trustwave.com/media/18925/final_spiderlabs_cyber-weapons-used-in-the-ukraine-russia-war.pdf
2022-04-06 Justice Department Announces Court-Authorized Disruption of Botnet Controlled by the Russian Federation’s Main Intelligence Directorate (GRU) https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-disruption-botnet-controlled-russian-federation 2022-02-23 New Sandworm Malware Cyclops Blink Replaces VPNFilter https://www.cisa.gov/uscert/ncas/alerts/aa22-054a2022-01-28 Lessons Learned From Successive Use of Offensive Cyber Operations Against Ukraine and What May Be Next https://www.crowdstrike.com/blog/lessons-from-past-cyber-operations-against-ukraine/
Targeted Sectors- Energy, Government, Logistics, Military, Technology, Telecom,
Targeted Countries- Australia,Belgium, Canada, China, Czech Republic, France,Germany, India, Iran, Italy, Mexico, Netherlands, Norway, Pakistan, Poland, Portugal, Spain, Sweden, Thailand, Turkey, Ukraine, United Kingdom,United States
Autonomous Systems- None Observed
Tactics, Techniques, and Procedures-
Reconnaissance
ID Name First Seen Last Seen
T1595.002 Active Scanning: Vulnerability Scanning 2025-02-12 2025-02-12
T1596.005 Search Open Technical Databases: Scan Databases 2025-02-12 2025-02-12
Resource Development
ID Name First Seen Last Seen
T1587.001 Develop Capabilities: Malware 2025-02-12 2026-09-09
Initial Access
ID Name First Seen Last Seen
T1190 Exploit Public-Facing Application 2025-02-12 2026-09-15
T1566 Phishing 2024-12-18 2025-02-12
Execution
ID Name First Seen Last Seen
T1059.001 Command and Scripting Interpreter: PowerShell 2024-12-18 2024-12-18
T1059.003 Command and Scripting Interpreter: Windows Command Shell 2024-12-18 2024-12-18
T1059.007 Command and Scripting Interpreter: JavaScript 2025-02-12 2025-02-12
T1203 Exploitation for Client Execution 2023-10-18 2026-01-28
Persistence
ID Name First Seen Last Seen
T1133 External Remote Services 2025-02-12 2025-02-12
T1505.003 Server Software Component: Web Shell 2025-02-12 2025-02-12
Privilege Escalation
(None Observed)
Defense Evasion
ID Name First Seen Last Seen
T1134 Access Token Manipulation 2026-02-19 2026-02-19
T1222 File and Directory Permissions Modification 2026-02-19 2026-02-19
T1222.001 File and Directory Permissions Modification: 2026-02-19 2026-02-19
Windows File and Directory Permissions Modification
T1564.003 Hide Artifacts: Hidden Window 2024-12-18 2024-12-18
Credential Access
(None Observed)
Discovery
ID Name First Seen Last Seen
T1082 System Information Discovery 2024-12-18 2024-12-18
T1083 File and Directory Discovery 2026-02-19 2026-02-19
T1680 Local Storage Discovery 2026-02-19 2026-02-19
Lateral Movement
(None Observed)
Collection
ID Name First Seen Last Seen
T1560 Archive Collected Data 2024-12-18 2024-12-18
Command and Control
ID Name First Seen Last Seen
T1090.003 Proxy: Multi-hop Proxy 2024-12-18 2024-12-18
T1572 Protocol Tunneling 2024-12-18 2024-12-18
T1573.002 Encrypted Channel: Asymmetric Cryptography 2024-12-18 2024-12-18
Exfiltration
ID Name First Seen Last Seen
T1041 Exfiltration Over C2 Channel 2024-12-18 2024-12-18
Impact
ID Name First Seen Last Seen
T1485 Data Destruction 2026-02-19 2026-02-19
T1529 System Shutdown/Reboot 2026-02-19 2026-02-19
