Interlock Ransomware Weaponizes Cisco FMC Zero‑Day for Root Access

Amazon Threat Intelligence has revealed that Interlock ransomware operators are exploiting a critical Cisco Secure Firewall Management Center (FMC) vulnerability (CVE‑2026‑20131) to gain unauthenticated root access. This flaw, rated CVSS 10.0, represents one of the most severe risks to enterprise firewall infrastructure in recent years.

The Vulnerability

• Root cause: Insecure deserialization of user‑supplied Java byte streams.
• Impact: Remote, unauthenticated attackers can bypass authentication and execute arbitrary Java code as root.
• Zero‑day window: Exploited since January 26, 2026, weeks before Cisco publicly disclosed the flaw.

Attack Chain Observed

1. Initial exploit: Crafted HTTP requests trigger arbitrary Java code execution.
2. Confirmation: Compromised system issues HTTP PUT request to attacker infrastructure.
3. Payload delivery: ELF binary fetched from remote server containing Interlock’s toolkit.
4. Toolkit components:
   • PowerShell reconnaissance script for Windows environment mapping.
   • Custom RATs (JavaScript/Java) with shell access, file transfer, SOCKS5 proxy, and self‑delete features.
   • Bash script configuring Linux servers as reverse proxies, with log erasure routines.
   • Memory‑resident web shell for encrypted command execution.
   • Lightweight beacon for infrastructure validation.
   • ConnectWise ScreenConnect for persistence.
   • Volatility Framework for memory forensics.

Why This Matters

• Zero‑day exploitation: Attackers had a head start before defenders knew to patch.
• Firewall compromise: FMC is a central management system — root access here enables network‑wide control.
• Operational sophistication: Interlock combines custom malware, living‑off‑the‑land techniques, and infrastructure laundering.
• Ransomware evolution: As profits decline, groups are shifting toward exploiting VPNs, firewalls, and built‑in tools for initial access.

Defensive Recommendations

• Patch immediately: Upgrade to Cisco’s fixed software release.
• Audit ScreenConnect deployments: Check for unauthorized installations.
• Defense‑in‑depth: Layered security controls to mitigate zero‑day exposure.
• Monitor indicators: Look for unusual outbound HTTP requests, log erasure routines, or memory‑resident shells.
• Restrict exposure: Limit FMC interfaces to trusted networks only.

Final Thought

The Interlock campaign illustrates the fundamental challenge of zero‑day exploits: even the best patching programs can’t protect during the window between exploit and disclosure. Defense‑in‑depth, strict privilege management, and proactive monitoring are essential to withstand this new wave of ransomware targeting network infrastructure itself.