[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHGIYvkLsV0Rsfj_iDcxK0cTJwyibJRBsekGg7Tc9ikg":3,"$fIftvosG5OL8BclO4pAe6yZBT36VLdSh3sEDsyUKATGk":53},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":50,"created_at":51,"updated_at":52,"published_at":32},"interlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce","Interlock Ransomware Exploits Cisco FMC Zero-Day for Unauthenticated Root RCE","CVE-2026-20131 (CVSS 10.0) in Cisco Secure Firewall Management Center enables unauthenticated remote code execution as root, driving active double-extortion campaigns against enterprise firewalls.","Interlock ransomware is actively exploiting a critical Cisco FMC zero-day (CVE-2026-20131) that allows unauthenticated remote attackers to execute arbitrary Java code as root, with double extortion and custom tooling.",[10,11,12,13,14],"Interlock","Cisco FMC","CVE-2026-20131","Ransomware","Zero-Day","# Interlock Ransomware Exploits Cisco FMC Zero-Day for Unauthenticated Root RCE\n\n*CVE-2026-20131 (CVSS 10.0) in Cisco Secure Firewall Management Center enables unauthenticated remote code execution as root, driving active double-extortion campaigns against enterprise firewalls.*\n\n**Tags:** `Interlock` `Cisco FMC` `CVE-2026-20131` `Ransomware` `Zero-Day`\n\n> Interlock ransomware is actively exploiting a critical Cisco FMC zero-day (CVE-2026-20131) that allows unauthenticated remote attackers to execute arbitrary Java code as root, with double extortion and custom tooling.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2026-20131 | 10.0 | 31.2% | ✅ listed | available | 89.75 (Critical) |\n\n## What happened\n\nAmazon Threat Intelligence identified an active Interlock ransomware campaign on March 18, 2026, exploiting a critical vulnerability in Cisco Secure Firewall Management Center (FMC) Software. The flaw, tracked as CVE-2026-20131, allows an unauthenticated remote attacker to execute arbitrary Java code as root on the device, enabling full control of the management interface.\n\nThe vulnerability stems from insecure deserialization in the web-based management interface. It carries a CVSS 3.1 score of 10.0 and an EPSS score of 31.2% (98th percentile), indicating a high probability of exploitation. Cisco has added the CVE to its Known Exploited Vulnerabilities catalog, and a proof-of-concept is available. The PRS risk score rates it at 89.75, placing it in the Critical band.\n\nInterlock, which Sophos tracks as GOLD EMBRACE and IBM X-Force as Hive0163, has been active since September 2024. The campaign combines the edge-device exploit with custom malware tooling and double extortion, stealing data before encryption and threatening to leak it on the group’s “Worldwide Secrets Blog.” The group was observed using the Cisco zero-day roughly two weeks before Cisco acknowledged it, consistent with its pattern of aggressive zero-day adoption.\n\n## Technical details\n\nThe vulnerability resides in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software. It stems from insecure deserialization of Java objects, allowing an unauthenticated remote attacker to execute arbitrary Java code with root privileges on the affected device. This grants full control of the management interface, including the ability to deploy, configure, and manage the underlying firewalls.\n\nThe flaw carries a CVSS 3.1 base score of 10.0, placing it at the maximum severity rating. The EPSS score of 31.2% sits at the 98th percentile, indicating a high probability of real-world exploitation. Cisco has added CVE-2026-20131 to its Known Exploited Vulnerabilities (KEV) catalog, and a proof-of-concept exploit is available. The PRS risk score rates the vulnerability at 89.75, which falls in the Critical band.\n\nInterlock leverages the zero-day to gain initial access on internet-facing FMC instances, then deploys its custom malware tooling for persistence and data exfiltration before encrypting the host. The group was observed using the Cisco zero-day roughly two weeks before Cisco acknowledged it, consistent with its pattern of aggressive zero-day adoption.\n\n## Who is affected\n\nThe campaign targets internet-facing Cisco Secure Firewall Management Center (FMC) instances, the management plane that sits in front of the underlying firewalls. Once the unauthenticated attacker executes arbitrary Java code as root, they control the FMC web interface and can deploy, configure, and manage the managed firewalls. Interlock then deploys its custom malware tooling for persistence and data exfiltration before encrypting the host, completing the double-extortion sequence.\n\nThe group has been active since September 2024 and currently focuses on North American and European targets in critical infrastructure. It is not a Ransomware-as-a-Service operation; the operators build their own malware and run their own attacks. The campaign combines the edge-device exploit with a custom RAT (NodeSnake\u002FInterlock RAT), a PHP-based backdoor for cross-platform persistence, and ClickFix-style social engineering for initial access. Data is stolen before encryption and leaked on the group’s “Worldwide Secrets Blog” if the ransom demand is not met.\n\nThe zero-day was observed in the wild roughly two weeks before Cisco acknowledged it, consistent with Interlock’s pattern of aggressive zero-day adoption. The CVSS 3.1 score of 10.0, EPSS 31.2% at the 98th percentile, and Cisco KEV listing confirm the severity and real-world exploitation probability. A proof-of-concept is available, and the PRS risk score of 89.75 places it in the Critical band.\n\n## What to do\n\nDefenders should apply the Cisco security patch for CVE-2026-20131 immediately on all internet-facing FMC instances. The vulnerability is unauthenticated and runs as root, so any instance exposed to the internet is exploitable without credentials. If the patch cannot be applied immediately, restrict access to the FMC web interface to trusted management IPs or place it behind a VPN. The FMC is the management plane, so a compromise here gives the attacker control over the underlying firewalls it manages.\n\nFor detection, look for the Interlock RAT (NodeSnake) and the PHP backdoor on the FMC host after initial access. The group deploys its custom tooling for persistence and data exfiltration before encryption, so the FMC should be treated as fully compromised once the Java code executes. A proof-of-concept exploit is available for verification. Cisco has listed the CVE in its KEV catalog, confirming active exploitation. The EPSS score of 31.2% at the 98th percentile reflects the high exploitation probability, and the PRS risk score of 89.75 places it in the Critical band.\n\nInterlock was observed using the zero-day roughly two weeks before Cisco acknowledged it, consistent with its pattern of aggressive zero-day adoption. The campaign targets North American and European critical infrastructure, so those teams should prioritize the patch and verify the FMC is the only internet-facing component. The group is not RaaS; the operators build their own malware and run their own attacks, so the tooling is custom and not a public drop.\n\n## Key points\n\n- CVE-2026-20131 is a CVSS 10.0 (3.1) vulnerability in Cisco Secure Firewall Management Center's web-based management interface.\n- The flaw allows unauthenticated remote attackers to execute arbitrary Java code as root via insecure deserialization.\n- Interlock ransomware is actively exploiting the zero-day with double extortion, custom RAT (NodeSnake), and ClickFix-style social engineering.\n- The campaign targets internet-facing Cisco FMC devices, collecting system, credential, and network data before deploying ransomware.\n- CVE-2026-20131 is in CISA KEV with 31.2% EPSS (98th percentile) and PRS risk 89.75 (Critical).\n\n## Further reading & sources\n\n- [Interlock Ransomware Attack | Outbreak Alert | FortiGuard Labs](https:\u002F\u002Ffortiguard.fortinet.com\u002Foutbreak-alert\u002Finterlock-ransomware) — FortiGuard Outbreak Alerts\n- [Interlock ransomware gang creates volatile situation | SOPHOS](https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fblog\u002F2608-volatility-interlock)\n- [Medium](https:\u002F\u002Fmedium.com\u002F@rst_cloud\u002Frst-ti-report-digest-15-jun-2026-4f2342fc18bd)\n- [Ransomware Tactics, Techniques, and Procedures in a Shifting Threat Landscape | Google Cloud Blog](https:\u002F\u002Fcloud.google.com\u002Fblog\u002Ftopics\u002Fthreat-intelligence\u002Fransomware-ttps-shifting-threat-landscape)\n- [Ransomware is the Scoreboard](https:\u002F\u002Fwww.recordedfuture.com\u002Fblog\u002Fransomware-is-the-scoreboard)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Finterlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce.png?v=092737b648",{"cves":18,"actors":27,"malware":34,"timeline":39,"technologies":44},[19],{"id":12,"kev":20,"poc":20,"url":21,"cvss":22,"epss":23,"risk_band":24,"risk_score":25,"cvss_version":26},true,"\u002Fvulnerabilities\u002FCVE-2026-20131",10,0.4317,"Critical",87,"3.1",[28],{"url":29,"name":10,"slug":30,"type":31,"origin":32,"motivation":33},"\u002Fthreat-groups\u002Finterlock","interlock","ransomware",null,"financial",[35,37],{"name":36},"NodeSnake",{"name":38},"Interlock Ransomware",[40],{"date":41,"event":42,"description":43},"2026-03-18","Campaign identified","Amazon threat intelligence identified active Interlock ransomware campaign",[45,48],{"vendor":46,"product":47},"Cisco","Secure Firewall Management Center (FMC) Software",{"vendor":46,"product":49},"Secure Firewall Management Center (FMC)","ransomware_incident","2026-08-31T07:05:12.614729+00:00","2026-10-16T12:29:01.15951+00:00",{"articles":54},[55,66,77,88],{"slug":56,"title":57,"summary":58,"tags":59,"hero_image_url":64,"story_type":50,"created_at":65},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","StormEncryptor ransomware deployed via N-central auth-bypass CVE-2026-18577","A former Medusa affiliate (Storm-1175) is actively deploying StormEncryptor ransomware through an incomplete patch for CVE-2026-18556 in N-able N-central, allowing unauthenticated remote attackers to bypass authentication and take over the RMM server to reach managed endpoints.",[60,61,62,13,63],"N-able N-central","CVE-2026-18577","StormEncryptor","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","2026-09-24T07:05:56.501709+00:00",{"slug":67,"title":68,"summary":69,"tags":70,"hero_image_url":75,"story_type":50,"created_at":76},"dragonforce-ransomware-hits-saudi-chemical-manufacturer","DragonForce Ransomware Hits Saudi Chemical Manufacturer","The DragonForce ransomware group has claimed a Saudi Arabian chemical manufacturer, adding to its Q2 2026 run of 144 victims and its ongoing campaign against Gulf-region industrial targets.",[71,13,72,73,74],"DragonForce","Saudi Arabia","Chemical Manufacturing","ASEC","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdragonforce-ransomware-hits-saudi-chemical-manufacturer.png?v=789ad783bf","2026-09-19T12:09:53.129912+00:00",{"slug":78,"title":79,"summary":80,"tags":81,"hero_image_url":86,"story_type":50,"created_at":87},"qilin-ransomware-tops-june-2026-with-83-cases-41-manufacturing-hits-92-us-victim","Qilin Ransomware Tops June 2026 with 83 Cases, 41 Manufacturing Hits, 92 US Victims","AhnLab ASEC's June 2026 Ransomware Trend Report shows Qilin as the most active group with 83 cases, 41 manufacturing incidents, and 92 US hits, while also targeting Musashino University, ISUZU Motors, and the Central Bank of Libya.",[82,13,83,84,85],"Qilin","AhnLab ASEC","Manufacturing","US","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fqilin-ransomware-tops-june-2026-with-83-cases-41-manufacturing-hits-92-us-victim.png?v=b915ec283d","2026-09-18T07:07:39.952851+00:00",{"slug":89,"title":90,"summary":91,"tags":92,"hero_image_url":98,"story_type":50,"created_at":99},"cisa-issues-stopransomware-advisory-for-gunra-ransomware","CISA Issues #StopRansomware Advisory for Gunra Ransomware","CISA has published a #StopRansomware advisory for the Gunra ransomware-as-a-service family, which first appeared in April 2025 and launched its formal RaaS affiliate program in January 2026, using a double-extortion model with a dedicated leak site and ChaCha20+RSA-4096 encryption on Windows and Linux.",[93,94,13,95,96,97],"CISA","Gunra","FortiOS","FortiProxy","CVE-2024-55591","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-issues-stopransomware-advisory-for-gunra-ransomware.png?v=b7e6a015f5","2026-08-27T17:06:47.703652+00:00"]