[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHGIYvkLsV0Rsfj_iDcxK0cTJwyibJRBsekGg7Tc9ikg":3,"$fIftvosG5OL8BclO4pAe6yZBT36VLdSh3sEDsyUKATGk":53},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":50,"created_at":51,"updated_at":52,"published_at":32},"interlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce","Interlock Ransomware Exploited Cisco FMC Flaw CVE-2026-20131 as a Zero-Day","Amazon reported in March 2026 that Interlock had exploited the CVSS 10.0 Cisco Secure Firewall Management Center flaw since 26 January, 36 days before Cisco disclosed it.","In March 2026 Amazon Threat Intelligence reported that the Interlock ransomware group had exploited CVE-2026-20131, an unauthenticated root-level Java deserialisation flaw in Cisco Secure Firewall Management Center, from 26 January 2026, 36 days before Cisco's 4 March disclosure. CISA added it to KEV on 19 March 2026.",[10,11,12,13,14],"Interlock","Cisco FMC","CVE-2026-20131","Ransomware","Zero-Day","# Interlock Ransomware Exploited Cisco FMC Flaw CVE-2026-20131 as a Zero-Day\n\n*Amazon reported in March 2026 that Interlock had exploited the CVSS 10.0 Cisco Secure Firewall Management Center flaw since 26 January, 36 days before Cisco disclosed it.*\n\n**Tags:** `Interlock` `Cisco FMC` `CVE-2026-20131` `Ransomware` `Zero-Day`\n\n> In March 2026 Amazon Threat Intelligence reported that the Interlock ransomware group had exploited CVE-2026-20131, an unauthenticated root-level Java deserialisation flaw in Cisco Secure Firewall Management Center, from 26 January 2026, 36 days before Cisco's 4 March disclosure. CISA added it to KEV on 19 March 2026.\n\n---\n\n## Vulnerability details\n\n| CVE | Description | CVSS | KEV added |\n|---|---|---|---|\n| CVE-2026-20131 | Cisco Secure FMC insecure Java deserialisation, unauthenticated code execution as root | 10.0 | 19 Mar 2026 |\n\n## What happened\n\nThis is a recap of events from March 2026. Cisco disclosed and patched CVE-2026-20131 on 4 March 2026, a maximum-severity flaw in the web-based management interface of Cisco Secure Firewall Management Center (FMC) software. Cisco warned that it \"could allow unauthenticated attackers to remotely execute arbitrary Java code as root on unpatched devices\". At disclosure, Cisco said it had no evidence of exploitation.\n\nOn 18 March 2026 Amazon Threat Intelligence reported that the Interlock ransomware group had been exploiting the flaw against enterprise firewalls since 26 January 2026: \"Interlock was exploiting this vulnerability 36 days before its public disclosure.\" Cisco updated its advisory the same day to acknowledge active exploitation, and CISA added the CVE to its Known Exploited Vulnerabilities catalogue on 19 March 2026, with a 22 March due date for federal civilian agencies.\n\n## What Amazon observed\n\nAccording to Help Net Security, Amazon's research drew on its MadPot honeypot sensors and on a server that acted as a hub for the attackers' tools. The tooling it described included:\n\n- a PowerShell script for enumerating and collecting information on Windows hosts;\n- a JavaScript remote access trojan that collects host information;\n- a Java implant providing redundant command and control;\n- a Bash script that turns a compromised Linux server into a temporary traffic relay;\n- a memory-resident web shell and a lightweight network beacon.\n\nThe attackers also used legitimate tools: ConnectWise ScreenConnect, Volatility and Certify. FortiGuard Labs summarises the activity as fileless implants, custom malware and remote access tooling, with reconnaissance and collection of system, credential and network data before ransomware deployment.\n\n## About Interlock\n\nInterlock emerged in September 2024. Sophos tracks it as GOLD EMBRACE and describes a small, dedicated team that builds its own malware rather than a ransomware-as-a-service operation. Sophos says the group currently focuses on North American and European targets in critical infrastructure, healthcare and education, uses double extortion, and leaks stolen data on its \"Worldwide Secrets Blog\". Its wider toolset, per Sophos, includes a custom remote access trojan known as NodeSnake or Interlock RAT, a PHP-based backdoor, and ClickFix-style social engineering. The sources do not say these specific tools were deployed through the FMC exploit.\n\n## What to do\n\n- Apply Cisco's fix for CVE-2026-20131 on every FMC instance (advisory cisco-sa-fmc-rce-NKhnULJh).\n- Keep the FMC management interface off the public internet; Cisco notes this reduces the attack surface.\n- Check logs for the indicators of compromise Amazon published, and treat any FMC that was exposed and unpatched between late January and patching as potentially compromised.\n\n## Key points\n\n- CVE-2026-20131 is a CVSS 10.0 insecure deserialisation flaw in the Cisco Secure FMC web interface that allows unauthenticated code execution as root.\n- Amazon says Interlock exploited it from 26 January 2026, 36 days before Cisco's 4 March disclosure.\n- CISA added it to KEV on 19 March 2026, with a 22 March due date.\n- Amazon observed custom scripts, a JavaScript RAT, a Java implant and a memory-resident web shell, alongside ScreenConnect, Volatility and Certify.\n- Interlock (GOLD EMBRACE) has been active since September 2024 and runs double-extortion attacks.\n\n## Further reading & sources\n\n- [Interlock ransomware exploited Secure FMC flaw in zero-day attacks since January](https:\u002F\u002Fbleepingcomputer.com\u002Fnews\u002Fsecurity\u002Finterlock-ransomware-exploited-secure-fmc-flaw-in-zero-day-attacks-since-january) (BleepingComputer)\n- [Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131)](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F03\u002F20\u002Fcisco-fmc-interlock-ransomware-cve-2026-20131\u002F) (Help Net Security)\n- [Interlock Ransomware Attack | Outbreak Alert](https:\u002F\u002Ffortiguard.fortinet.com\u002Foutbreak-alert\u002Finterlock-ransomware) (FortiGuard Labs)\n- [Interlock ransomware gang creates volatile situation](https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fblog\u002F2608-volatility-interlock) (Sophos)\n","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Finterlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce.png?v=092737b648",{"cves":18,"actors":27,"malware":34,"timeline":39,"technologies":44},[19],{"id":12,"kev":20,"poc":20,"url":21,"cvss":22,"epss":23,"risk_band":24,"risk_score":25,"cvss_version":26},true,"\u002Fvulnerabilities\u002FCVE-2026-20131",10,0.4317,"Critical",87,"3.1",[28],{"url":29,"name":10,"slug":30,"type":31,"origin":32,"motivation":33},"\u002Fthreat-groups\u002Finterlock","interlock","ransomware",null,"financial",[35,37],{"name":36},"NodeSnake",{"name":38},"Interlock Ransomware",[40],{"date":41,"event":42,"description":43},"2026-03-18","Campaign identified","Amazon threat intelligence identified active Interlock ransomware campaign",[45,48],{"vendor":46,"product":47},"Cisco","Secure Firewall Management Center (FMC) Software",{"vendor":46,"product":49},"Secure Firewall Management Center (FMC)","ransomware_incident","2026-08-31T07:05:12.614729+00:00","2026-10-16T12:29:01.15951+00:00",{"articles":54},[55,66,77,89],{"slug":56,"title":57,"summary":58,"tags":59,"hero_image_url":64,"story_type":50,"created_at":65},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","N-central auth bypass CVE-2026-18577 exploited; Microsoft links attacks to StormEncryptor actor","Attackers exploited CVE-2026-18577, an incomplete patch for the N-able N-central authentication bypass CVE-2026-18556, to take over N-central servers and reach managed endpoints. Microsoft believes the actor may be Storm-1175, which has switched from Medusa to a new ransomware strain, StormEncryptor.",[60,61,62,13,63],"N-able N-central","CVE-2026-18577","StormEncryptor","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","2026-09-24T07:05:56.501709+00:00",{"slug":67,"title":68,"summary":69,"tags":70,"hero_image_url":75,"story_type":50,"created_at":76},"dragonforce-ransomware-hits-saudi-chemical-manufacturer","DragonForce Ransomware Claims Attack on Saudi Chemical Manufacturer","DragonForce has claimed an attack on a Saudi Arabian chemical manufacturer, listed in AhnLab ASEC's dark web roundup of 16 July 2026. The claim comes from the group itself and has not been independently confirmed. Industry trackers count DragonForce among the most active ransomware operations of Q2 2026, though their victim totals differ.",[71,13,72,73,74],"DragonForce","Saudi Arabia","Chemical Manufacturing","ASEC","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdragonforce-ransomware-hits-saudi-chemical-manufacturer.png?v=789ad783bf","2026-09-19T12:09:53.129912+00:00",{"slug":78,"title":79,"summary":80,"tags":81,"hero_image_url":87,"story_type":50,"created_at":88},"cisa-issues-stopransomware-advisory-for-gunra-ransomware","CISA Issues #StopRansomware Advisory for Gunra Ransomware","On 10 August 2026 the FBI, CISA, DC3, NSA, the US Secret Service and the Republic of Korea's National Police Agency published #StopRansomware advisory AA26-222A on Gunra, a ransomware family first seen in April 2025 that launched a formal RaaS affiliate programme in January 2026 and uses ChaCha20 and RSA-4096 encryption with double extortion.",[82,83,13,84,85,86],"CISA","Gunra","FortiOS","FortiProxy","CVE-2024-55591","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-issues-stopransomware-advisory-for-gunra-ransomware.png?v=b7e6a015f5","2026-08-27T17:06:47.703652+00:00",{"slug":90,"title":91,"summary":92,"tags":93,"hero_image_url":99,"story_type":100,"created_at":101},"fortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation","Fortinet FortiMail Zero-Day CVE-2026-104286 Under Active Exploitation","Fortinet disclosed a critical FortiMail zero-day, CVE-2026-104286, on 1 October 2026. It is exploited in the wild, rated CVSS 9.8 by Fortinet, and was added to CISA's KEV catalog the same day. It affects FortiMail 7.2.0 through 8.0.1; fixes are in 7.4.9, 7.6.7 and 8.0.2.",[94,95,96,97,98,14],"Fortinet","FortiMail","CVE-2026-104286","Path Traversal","CISA KEV","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortinet-fortimail-zero-day-cve-2026-104286-under-active-exploitation.png?v=fe5d35df3a","vulnerability_disclosure","2026-10-17T12:03:14.799873+00:00"]