Cisco ASA, FTD Critical Zero-Day Actively Exploited for Interlock Ransomware

Key Takeaways

• A critical zero-day vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) Software is under active exploitation.
• The Interlock ransomware group began exploiting the flaw 36 days before Cisco’s public disclosure, gaining a significant head start.
• The vulnerability allows unauthenticated remote attackers to execute arbitrary Java code with root privileges.
• Interlock employs a sophisticated toolkit, including custom RATs, legitimate tools, and methods to erase forensic evidence.
• Organizations are urged to apply the latest security patches immediately and focus on behavioral detection rather than static file hashes.

Cisco Firewall Zero-Day Actively Exploited by Interlock Ransomware

A severe zero-day vulnerability, identified as CVE-2026-20131, within Cisco Secure Firewall Management Center (FMC) Software is currently being leveraged in active attacks by the Interlock ransomware syndicate. This critical flaw allows remote, unauthenticated attackers to execute arbitrary Java code with root privileges on affected systems.

Cisco publicly disclosed the vulnerability on March 4, 2026. However, threat intelligence researchers at Amazon uncovered Interlock’s exploitation of this flaw beginning January 26, 2026 — a full 36 days prior to the public announcement. This substantial head start enabled the ransomware group to aggressively compromise organizations before defenders were even aware of the threat. Amazon shared its findings with Cisco to aid in their investigation, confirming that AWS infrastructure and customer workloads were not implicated in this campaign.

The investigation into Interlock’s operations significantly advanced when a misconfigured infrastructure server inadvertently exposed the group’s entire operational toolkit. Early threat activity observed involved HTTP requests directed at a vulnerable software path, containing attempts at Java code execution and embedded URLs. These URLs served to deliver configuration data and confirm successful exploitation by triggering an HTTP PUT request to upload a generated file. By simulating a compromised system, researchers were able to prompt the attackers to deploy a malicious Linux ELF binary. The exposed staging server further revealed that the group meticulously organized artifacts into dedicated paths for each individual target, streamlining both the download of their tools and the upload of exfiltrated operational data.

Attribution and Targeting Strategy

Technical indicators confidently link this ongoing campaign to the Interlock ransomware family, a financially motivated group that first appeared in September 2024. The recovered ELF binary, the embedded ransom note, and the TOR negotiation portal all align with established Interlock branding. Their ransom notes are particularly notable for uniquely citing regulatory exposure, a tactic designed to maximize pressure on victims and consistent with their known double extortion model.

Temporal analysis of timestamps by the Amazon threat intelligence team suggests the actors behind Interlock operate within the UTC+3 timezone. Historically, Interlock focuses its attacks on sectors where operational disruption can force rapid payment, primarily targeting organizations in education, engineering, construction, manufacturing, healthcare, and government.

Interlock’s Sophisticated Toolkit and Tactics

Upon gaining initial access, Interlock deploys a sophisticated array of tools to escalate privileges and maintain persistence within compromised environments. A recovered PowerShell script conducts extensive enumeration of Windows environments, gathering system details, browser artifacts, and network connection information. The script organizes these findings into dedicated directories for each host and compresses them into ZIP archives, indicating preparation for an organization-wide encryption event.

The group employs custom remote access trojans (RATs) implemented in both JavaScript and Java. The JavaScript implant utilizes Windows Management Instrumentation for system profiling and establishes persistent WebSocket connections with RC4-encrypted messages. This provides interactive shell access, file transfer capabilities, and SOCKS5 proxy functionality. A functionally identical Java backdoor, built on GlassFish libraries, ensures redundant access for the attackers.

To obscure their activities, attackers deploy a Bash script that configures Linux servers as HTTP reverse proxies. This script installs HAProxy to forward traffic and aggressively erases logs every five minutes. Additionally, a fileless, memory-resident Java webshell intercepts HTTP requests containing AES-128 encrypted commands using a hardcoded seed.

Interlock also abuses legitimate tools in its operations, including ConnectWise ScreenConnect for remote access, Volatility for memory forensics, and Certify for Active Directory exploitation, alongside its custom malware.

What You Should Do

• Organizations running Cisco Secure Firewall Management Center must apply the latest security patches immediately to address CVE-2026-20131.
• Given that the threat actor heavily customized downloaded artifacts for each individual target network, traditional file hashes are largely unreliable for signature-based detection.
• Defenders should instead prioritize identifying behavioral patterns, memory-resident anomalies, and the specific network reconnaissance tactics associated with Interlock’s multifaceted attack chain.
• Implement robust network segmentation and multi-factor authentication across all critical systems.
• Regularly back up critical data and test restoration procedures to minimize the impact of a ransomware attack.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.