Loading story…
Interlock ransomware exploited CVE-2026-20131, a maximum-severity zero-day in Cisco Secure Firewall Management Center (FMC), more than a month before Cisco publicly disclosed and patched the flaw. The vulnerability allows an unauthenticated remote attacker to execute arbitrary Java code as root, giving attackers full control of exposed systems. Amazon security researchers said exploitation began on January 26, or 36 days before Cisco’s March 4 disclosure, and Cisco later updated its advisory to reflect the in-the-wild abuse and urged customers to patch immediately.
Amazon linked the activity to Interlock through exploit traffic observed in its MadPot honeypot network and through a misconfigured Interlock server that exposed the group’s operational toolkit. Researchers observed HTTP requests targeting a vulnerable path with embedded Java execution attempts, followed by URLs used to deliver configuration data and confirm successful compromise via an HTTP PUT upload. By emulating a victim host, investigators triggered delivery of a malicious Linux ELF payload, and the exposed staging server showed target-specific directories used to distribute tools and collect stolen data. The recovered payloads, ransom note, and Tor-based negotiation portal matched known Interlock tradecraft and supported attribution to the group’s double-extortion operations.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-20131 to its Known Exploited Vulnerabilities catalog on March 19, 2026, citing evidence of active exploitation. The agency ordered federal civilian executive branch agencies to remediate the issue by March 22, 2026.
On March 18, 2026, Amazon published research attributing the pre-disclosure exploitation campaign to Interlock based on ransom note branding, a TOR negotiation portal, victim-tracking patterns, and recovered malware. Amazon said it had not observed AWS infrastructure or customer workloads being involved and urged affected organizations to patch and hunt for indicators of compromise.
Cisco publicly disclosed CVE-2026-20131 and released patches on March 4, 2026, for Cisco Secure Firewall Management Center, with reporting also noting impact to Cisco Security Cloud Control Firewall Management. The advisory was later updated after Amazon shared evidence that the flaw had already been exploited in the wild.
During its investigation, Amazon used its MadPot honeypot network and identified a misconfigured Interlock staging server that exposed the group's operational toolkit. The infrastructure revealed custom RATs, reconnaissance scripts, proxy tooling, fileless Java backdoors, and other post-exploitation tradecraft used in the campaign.
Amazon threat intelligence observed Interlock exploiting CVE-2026-20131 in Cisco Secure Firewall Management Center starting on January 26, 2026, 36 days before public disclosure. The unauthenticated insecure deserialization flaw allowed arbitrary Java code execution as root on vulnerable devices.
U.S. federal agencies and later reporting said the Interlock ransomware operation emerged in September 2024. The group was described as a smaller ransomware actor running its own malware and targeting sectors including education, healthcare, government, and other critical infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 28 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
15 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethecyberthrone.in
Open sourcehelpnetsecurity.com
Open sourcescworld.com
Open sourceaws.amazon.com
Open sourcebankinfosecurity.com
Open sourcego.theregister.com
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Interlock ransomware** has been actively exploiting **CVE-2026-20131**, a critical `CVSS 10.0` insecure deserialization flaw in **Cisco Secure Firewall Management Center (FMC)**, to gain unauthenticated remote code execution and run arbitrary Java code as `root` on vulnerable devices. Amazon Threat Intelligence reported that exploitation began on **January 26, 2026**, roughly **36 days before** Cisco publicly disclosed and patched the issue on March 4, giving the threat actor a meaningful zero-day window against enterprise firewall management infrastructure. Amazon said its **MadPot** sensor network and an attacker **misconfigured infrastructure server** exposed Interlock’s broader operational toolkit, including a **multi-stage attack chain**, **custom remote access trojans**, reconnaissance scripts, and evasion methods. Reporting indicates the attacks used crafted HTTP requests against a specific FMC path, followed by outbound confirmation traffic and retrieval of additional **ELF binaries** from remote infrastructure. Cisco acknowledged Amazon’s findings, updated its advisory, and urged customers to patch immediately, while Amazon said it did **not** observe AWS infrastructure or customer workloads on AWS being involved in the campaign.
Jun 29, 2026
Sophos reported that the Interlock ransomware group, also tracked as **GOLD EMBRACE**, used legitimate memory-forensics tools including **WinPmem** and **Volatility3** to steal Windows credentials during a March 2026 intrusion. The attack began with a **ClickFix** social-engineering lure on a compromised website after a user searched for Dynamics 365 via ChatGPT and was tricked into pasting a malicious command. That command downloaded PowerShell code and installed a remote-access payload on an unprotected Windows 10 endpoint, giving the attackers an initial foothold. Over roughly 26 hours, the attackers conducted LDAP discovery, privilege escalation, **Kerberoasting**, and NTLM downgrade-based lateral movement before reaching a domain controller. Sophos said Interlock used the forensic tools to extract NTLM and LM hashes, local account data, cached domain credentials, and other secrets, then created new domain-admin accounts, established persistence with a scheduled task and `node.exe`, tampered with Microsoft Defender, exfiltrated sensitive data including AWS credentials, and ultimately deployed ransomware that locked the victim out of hypervisors. The campaign reflects Interlock’s broader double-extortion operations against organizations in North America and Europe, including critical infrastructure, healthcare, and education, and its use of malware such as **NodeSnake** and **InterlockRAT**.
Aug 10, 2026
Interlock ransomware has been highlighted as a threat actor that gains initial access through **ClickFix-style social engineering** and **fake CAPTCHA** lures rather than relying on a software exploit. The activity described shows operators tricking users into executing malicious actions, then harvesting credentials and moving laterally by abusing identity, access, and configuration weaknesses inside enterprise environments before deploying ransomware. Reporting on the broader ransomware landscape says the threat remains highly effective at scale, with Recorded Future tracking **13,000 victims** and **834 ransomware families or brands** over the past two years. The coverage points to Interlock as an example of how modern ransomware operations can bypass defenses focused mainly on CVE patching and compliance checklists, reinforcing CISA-linked guidance that organizations should prioritize mitigation of attack paths, credential abuse, and lateral movement risks alongside traditional vulnerability management.
Jul 24, 2026