Interlock Ransomware Exploited Cisco Firewall Zero-Day for 36 Days Before Patch
Amazon threat intelligence reveals that the Interlock ransomware group exploited a critical Cisco Secure Firewall Management Center zero-day vulnerability for over five weeks before Cisco disclosed and patched the flaw in early March 2026.
A critical zero-day vulnerability in Cisco Secure Firewall Management Center (FMC) software was exploited by the Interlock ransomware group for 36 days before Cisco publicly disclosed and patched the flaw, according to findings from Amazon’s threat intelligence teams.
The vulnerability, tracked as CVE-2026-20131 and carrying the maximum CVSS score of 10.0, stems from insecure deserialization of user-supplied Java byte streams in the FMC web interface. An unauthenticated remote attacker can exploit the flaw to bypass authentication entirely and execute arbitrary Java code with root privileges on affected devices, as reported by The Hacker News. A second related vulnerability, CVE-2026-20079, also received an identical 10.0 severity rating as part of the same Cisco advisory, according to CSO Online.
Exploitation Timeline
Interlock began exploiting CVE-2026-20131 on January 26, 2026, more than a month before Cisco disclosed the flaw and released patches on March 4 as part of its semiannual firewall security update, according to CSO Online. Amazon confirmed active exploitation on March 18 through its MadPot sensor network, a honeypot infrastructure designed to detect and attribute threat activity, according to The Hacker News. The Cybersecurity and Infrastructure Security Agency (CISA) subsequently set a March 22 deadline for U.S. federal agencies to apply remediation.
Amazon CISO CJ Moses characterized the severity of the gap, stating that Interlock had a zero-day giving them a significant head start over defenders, as reported by The Hacker News.
Attack Chain
The attack sequence begins with crafted HTTP requests sent to a specific path in the FMC software to trigger arbitrary Java code execution. Once a system is compromised, it issues an HTTP PUT request to an external server to confirm successful exploitation. The attacker then delivers an ELF binary from a remote server, which serves as a foothold for deploying additional tools, according to Amazon’s security blog.
An operational security failure by the threat actors exposed their full toolkit through misconfigured infrastructure. Researchers attributed the group’s operations to a UTC+3 timezone based on activity patterns, as The Hacker News reported.
Post-Exploitation Toolkit
Interlock deployed a substantial arsenal once inside victim networks. The toolkit included PowerShell reconnaissance scripts for Windows environment enumeration, custom JavaScript and Java remote access trojans capable of command execution, file transfer, SOCKS5 proxy tunneling, and self-updating. The group also used Bash reverse proxy scripts that laundered HTTP traffic through HAProxy on port 80 and erased logs via cron jobs, according to The Hacker News.
Memory-resident web shells with encrypted command payloads, lightweight network beacons, and installations of ConnectWise ScreenConnect for persistent access rounded out the attackers’ capabilities. The group further leveraged the Volatility Framework and Certify for credential theft and Active Directory Certificate Services exploitation, as reported by The Hacker News.
Interlock first appeared in 2024 and is believed to be a possible offshoot of the Rhysida ransomware-as-a-service group, which was responsible for the 2023 British Library attack. Previous Interlock targets have spanned the education, engineering, healthcare, government, and public sectors, according to CSO Online.
Remediation
Cisco has released patches addressing the vulnerability and recommends that organizations restrict public internet access to FMC management interfaces. Cisco advises using its software checker tool to determine appropriate updates, as procedures vary by FMC version, according to CSO Online. Amazon has published IP addresses, domains, and JA3 fingerprints to assist organizations in searching forensic logs for indicators of compromise, according to Amazon’s security blog.
Security teams are further advised to review ScreenConnect deployments for unauthorized installations and implement defense-in-depth strategies with layered security controls, as The Hacker News reported. With Interlock operating undetected for over five weeks, organizations running Cisco FMC should treat unpatched systems as potentially compromised.