Cisco Firewall Zero-Day Actively Exploited to Deliver Interlock Ransomware
Security research has identified an active Interlock ransomware campaign exploiting a critical zero-day vulnerability in Cisco Secure Firewall Management Center (FMC) software.
Security research has identified an active Interlock ransomware campaign exploiting a critical zero-day vulnerability in Cisco Secure Firewall Management Center (FMC) software.
This campaign utilizes an unauthenticated remote code execution flaw via the Amazon MadPot network, compromising enterprise environments for over a month before public disclosure.
The intrusion campaign targets CVE-2026-20131, an insecure deserialization vulnerability tracked as CWE-502 within the web-based management interface of Cisco Secure FMC software.
By sending a maliciously crafted serialized Java object, an unauthenticated remote attacker can execute arbitrary Java code and gain root privileges.
This critical flaw carries a maximum CVSS base score of 10.0, indicating the highest possible risk.
While Cisco Security Cloud Control (SCC) is also vulnerable, the widely deployed Adaptive Security Appliance (ASA) and Threat Defense (FTD) software configurations remain unaffected.
Researchers identified threat activity exploiting this vulnerability beginning January 26, 2026, granting Interlock a 36-day advantage before Cisco’s public disclosure.
Initial exploit attempts involved complex HTTP requests containing embedded URLs specifically designed to deliver configuration data to the targeted firewalls.
By sending a maliciously crafted serialized Java object, an unauthenticated remote attacker can execute arbitrary Java code and gain root privileges.
A misconfigured attacker staging server eventually exposed Interlock’s multi-stage operational toolkit, providing security teams with visibility into their methodology.
Upon gaining network access, operators deploy a comprehensive PowerShell script designed for systematic Windows environment enumeration.
This script maps the target environment by collecting hardware details, virtual machine inventories, and active network connections, compressing the data into host-specific archives for exfiltration.
To maintain persistent administrative control, Interlock uses sophisticated, custom remote access trojans developed in both JavaScript and Java.
The JavaScript variant establishes WebSocket connections using rotating RC4 encryption keys, while the Java variant provides redundant backdoor access through GlassFish libraries.
Furthermore, attackers deploy a memory-resident webshell that dynamically decrypts incoming command payloads to avoid writing detectable files to disk.
Based on temporal artifact analysis, Interlock operators most likely operate from the UTC+3 time zone and focus heavily on sectors where operational disruption maximizes ransom leverage.
The syndicate primarily targets vulnerable organizations across education, manufacturing, healthcare, and critical engineering worldwide.
In a unique extortion tactic, their custom ransom notes cite data protection regulations to threaten victims with compliance fines alongside data encryption.
As no viable workarounds exist to mitigate this deserialization flaw, immediate software updates are the only definitive defense against this critical vulnerability.
Organizations operating Cisco Secure Firewall Management Center must apply the official security patches immediately to secure their perimeter infrastructure.
Following the patching process, network defenders should thoroughly review indicators of compromise to hunt for any existing memory-resident anomalies within their active environments.
Based on reporting by GBHackers.