Interlock Ransomware Group Exploits Cisco FMC Zero-Day Vulnerability 36 Days Before Disclosure

Key Findings

* Interlock ransomware group exploited CVE-2026-20131 in Cisco FMC 36 days before public disclosure

* Zero-day vulnerability allows unauthenticated remote code execution with root privileges

* Amazon Threat Intelligence discovered exploitation using global honeypot network

* Attackers used sophisticated multi-stage attack with custom tools and evasion techniques

* Targeted sectors include education, healthcare, industry, and government

Background

The Interlock ransomware group has been active since September 2024, targeting multiple organizations across critical infrastructure sectors. The discovery of their exploitation of the Cisco Secure Firewall Management Center (FMC) vulnerability represents a significant breach in cybersecurity defenses. The vulnerability (CVE-2026-20131) is a critical remote code execution flaw with a maximum CVSS score of 10.0, allowing attackers to execute arbitrary code as root through insecure Java deserialization.

Exploitation Methodology

Amazon's threat intelligence uncovered the attack chain, which began on January 26, 2026. The group's approach involved sophisticated techniques including:

* Crafted HTTP requests targeting specific software paths

* Execution of arbitrary Java code

* Deployment of custom remote access trojans

* Systematic network reconnaissance

* Advanced infrastructure obfuscation techniques

Toolkit and Capabilities

The recovered attacker toolkit included:

* PowerShell reconnaissance scripts

* Custom JavaScript and Java remote access trojans

* Bash scripts for infrastructure laundering

* Memory-resident web shells

* Network beaconing tools

* Remote access utilities like ScreenConnect

Operational Characteristics

* Likely operates in UTC+3 timezone

* Targets organizations where disruption maximizes ransom potential

* Uses encrypted communication channels

* Implements aggressive log removal and evasion techniques

* Demonstrates sophisticated multi-stage attack capabilities

Mitigation Recommendations

* Apply Cisco FMC patches immediately

* Conduct comprehensive security assessments

* Review remote access tool deployments

* Implement defense-in-depth security strategies

* Monitor for indicators of compromise related to the Interlock group

Impact and Implications

The discovery highlights the critical window of vulnerability between zero-day exploitation and public disclosure. It underscores the importance of proactive threat hunting and multi-layered security approaches in protecting against sophisticated ransomware groups.

Sources

• https://securityaffairs.com/189636/malware/interlock-group-exploiting-the-cisco-fmc-flaw-cve-2026-20131-36-days-before-disclosure.html

• https://thehackernews.com/2026/03/interlock-ransomware-exploits-cisco-fmc.html