# Sandworm FMC intrusion cluster

> As of 2026-09-23, Sandworm FMC intrusion cluster is a threat actor tracked by Threadlinqs Intelligence across 1 threat spanning vulnerability.

- **Tracked threats:** 1
- **Categories:** VULNERABILITY
- **As of:** 2026-09-23

## Tracked threats

- [Eclypsium InfraTrust Report: Mass Active Exploitation of Network Management Systems (Cisco FMC/ISE CVE-2026-20079, CVE-2026-76460; SonicWall SMA 1000 CVE-2026-83548/83549; Linux Kernel CopyFail CVE-2026-31431)](https://intel.threadlinqs.com/threat/TL-2026-2630) — CRITICAL

## Related CVEs

15 CVEs referenced by tracked Sandworm FMC intrusion cluster activity.

- [CVE-2026-91843](https://intel.threadlinqs.com/cve/CVE-2026-91843)
- [CVE-2026-85103](https://intel.threadlinqs.com/cve/CVE-2026-85103)
- [CVE-2026-85102](https://intel.threadlinqs.com/cve/CVE-2026-85102)
- [CVE-2026-83549](https://intel.threadlinqs.com/cve/CVE-2026-83549)
- [CVE-2026-83548](https://intel.threadlinqs.com/cve/CVE-2026-83548)
- [CVE-2026-76460](https://intel.threadlinqs.com/cve/CVE-2026-76460)
- [CVE-2026-73456](https://intel.threadlinqs.com/cve/CVE-2026-73456)
- [CVE-2026-73453](https://intel.threadlinqs.com/cve/CVE-2026-73453)
- [CVE-2026-6485](https://intel.threadlinqs.com/cve/CVE-2026-6485)
- [CVE-2026-33197](https://intel.threadlinqs.com/cve/CVE-2026-33197)
- [CVE-2026-31431](https://intel.threadlinqs.com/cve/CVE-2026-31431)
- [CVE-2026-20316](https://intel.threadlinqs.com/cve/CVE-2026-20316)
- [CVE-2026-20293](https://intel.threadlinqs.com/cve/CVE-2026-20293)
- [CVE-2026-20212](https://intel.threadlinqs.com/cve/CVE-2026-20212)
- [CVE-2026-20079](https://intel.threadlinqs.com/cve/CVE-2026-20079)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Sandworm%20FMC%20intrusion%20cluster