Loading story…
Interlock ransomware has been actively exploiting CVE-2026-20131, a critical CVSS 10.0 insecure deserialization flaw in Cisco Secure Firewall Management Center (FMC), to gain unauthenticated remote code execution and run arbitrary Java code as root on vulnerable devices. Amazon Threat Intelligence reported that exploitation began on January 26, 2026, roughly 36 days before Cisco publicly disclosed and patched the issue on March 4, giving the threat actor a meaningful zero-day window against enterprise firewall management infrastructure.
Amazon said its MadPot sensor network and an attacker misconfigured infrastructure server exposed Interlock’s broader operational toolkit, including a multi-stage attack chain, custom remote access trojans, reconnaissance scripts, and evasion methods. Reporting indicates the attacks used crafted HTTP requests against a specific FMC path, followed by outbound confirmation traffic and retrieval of additional ELF binaries from remote infrastructure. Cisco acknowledged Amazon’s findings, updated its advisory, and urged customers to patch immediately, while Amazon said it did not observe AWS infrastructure or customer workloads on AWS being involved in the campaign.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
On March 18, 2026, Amazon threat intelligence reported that Interlock had exploited the Cisco flaw as a zero-day for 36 days before disclosure and attributed the activity to the ransomware group. The report described a multi-stage intrusion chain, including crafted HTTP requests, payload retrieval, custom RATs, reconnaissance tooling, a memory-resident web shell, and ScreenConnect-based persistence, aided by an operational security mistake that exposed Interlock infrastructure.
Cisco publicly disclosed CVE-2026-20131 and released fixes on March 4, 2026, warning that the flaw could let unauthenticated attackers execute arbitrary Java code as root on unpatched Secure FMC devices. The company urged customers to upgrade immediately.
The Interlock ransomware group started exploiting CVE-2026-20131, a maximum-severity insecure deserialization flaw in Cisco Secure Firewall Management Center, on or about January 26, 2026. The bug allowed unauthenticated remote code execution as root on affected devices before any public disclosure or patch was available.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcedarkreading.com
Open sourcecsoonline.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Interlock ransomware** exploited **CVE-2026-20131**, a maximum-severity zero-day in **Cisco Secure Firewall Management Center (FMC)**, more than a month before Cisco publicly disclosed and patched the flaw. The vulnerability allows an unauthenticated remote attacker to execute arbitrary Java code as `root`, giving attackers full control of exposed systems. Amazon security researchers said exploitation began on **January 26**, or **36 days before** Cisco’s March 4 disclosure, and Cisco later updated its advisory to reflect the in-the-wild abuse and urged customers to patch immediately. Amazon linked the activity to Interlock through exploit traffic observed in its **MadPot** honeypot network and through a **misconfigured Interlock server** that exposed the group’s operational toolkit. Researchers observed HTTP requests targeting a vulnerable path with embedded Java execution attempts, followed by URLs used to deliver configuration data and confirm successful compromise via an HTTP `PUT` upload. By emulating a victim host, investigators triggered delivery of a malicious **Linux ELF** payload, and the exposed staging server showed target-specific directories used to distribute tools and collect stolen data. The recovered payloads, ransom note, and **Tor-based negotiation portal** matched known Interlock tradecraft and supported attribution to the group’s **double-extortion** operations.
Jul 23, 2026
Cisco Talos reported active exploitation of two Cisco Secure Firewall Management Center (FMC) vulnerabilities: **CVE-2026-20079**, a critical CVSS 10.0 authentication-bypass flaw that lets unauthenticated remote attackers execute scripts and gain root access, and **CVE-2026-20316**, a CVSS 5.3 issue allowing login through a low-privileged account. Cisco has issued hotfixes for both flaws and plans a broader hardening release; organizations should apply the hotfixes immediately and review FMC systems for compromise. Talos linked the intrusions to three post-compromise activity clusters. UAT-12197 installed a JSP web shell and command-execution JAR to steal credentials; UAT-11823 deployed reverse-shell and proxy tooling alongside **Cyclops Blink**; and UAT-11988 performed ransomware precursor activity consistent with Qilin affiliates. Cyclops Blink is a modular, persistent network-device malware previously associated by CISA and partner agencies with Sandworm activity, capable of encrypted command-and-control, file download, and execution.
Sep 14, 2026
Amazon's threat intelligence team uncovered an advanced persistent threat (APT) actor actively exploiting two previously unknown zero-day vulnerabilities in Cisco Identity Services Engine (ISE) and Citrix NetScaler ADC. The vulnerabilities, tracked as CVE-2025-5777 (Citrix Bleed 2) and CVE-2025-20337, allowed attackers to bypass authentication on Citrix NetScaler and achieve unauthenticated remote code execution on Cisco ISE, respectively. Amazon's MadPot honeypot network detected exploitation attempts before public disclosure, and further investigation revealed the deployment of a custom web shell disguised as a legitimate Cisco ISE component, enabling persistent access for the attackers. Both vulnerabilities were exploited in the wild before patches were available, highlighting the attackers' sophistication and their focus on critical identity and network access infrastructure. The campaign demonstrated the threat actors' ability to quickly weaponize vulnerabilities and exploit patch gaps, with Amazon sharing technical details and indicators of compromise with Cisco to aid in remediation. The custom malware used in these attacks was specifically tailored for Cisco ISE environments, and the exploitation activity underscores the increasing targeting of systems that enforce enterprise security policies and manage authentication. Both Cisco and Citrix have since released patches to address the vulnerabilities, but the incident serves as a warning about the risks posed by zero-day exploitation of core network and identity management platforms.
Jun 29, 2026