cyber.hendryadrian.com
Threat Research · thecyberexpress.com

Amazon Reports Interlock Exploited Cisco FMC Zero-Day 36 Days Before Disclosure

· Original article ↗

Summary

Amazon says MadPot observed Interlock exploiting CVE-2026-20131 in Cisco Secure FMC from Jan. 26, 36 days before disclosure. Its research details the toolkit and post-exploitation methods; Amazon says its cloud customers were unaffected.

Key points

  • Amazon MadPot recorded exploitation of CVE-2026-20131 beginning Jan. 26, 2026, 36 days before Cisco disclosed the flaw.
  • The flaw allows unauthenticated remote execution of arbitrary Java code with root privileges on affected Cisco FMC devices.
  • Crafted HTTP requests delivered Java code; a follow-up HTTP PUT request was used to verify successful compromise.
  • A misconfigured attacker infrastructure server exposed reconnaissance scripts, custom RATs, and evasion tools; directories separated tool distribution and data collection by target.
  • A PowerShell script collected system and network details and organized the data into ZIP archives for exfiltration.
  • The JavaScript and Java RATs maintained access; the JavaScript version used encrypted WebSocket communications with RC4 and unique keys per transmission.
  • Other observed techniques included a memory-resident Java webshell, a Bash reverse-proxy script that erased logs every five minutes, and ConnectWise ScreenConnect for remote access.

Article Details

Attack Vectors
  • Interlock exploited CVE-2026-20131 through crafted HTTP requests to specific paths on affected Cisco Secure Firewall Management Center devices, enabling unauthenticated remote execution of Java code with root privileges.
  • After the exploit verification mechanism was triggered, the attackers issued commands to download and execute a malicious Linux binary.
  • Post-exploitation activity included PowerShell reconnaissance, JavaScript- and Java-based RATs communicating with C2 servers over encrypted WebSockets, and a memory-resident Java webshell.
  • The attackers used compromised Linux servers as HTTP reverse proxies, erased logs every five minutes, and deployed ConnectWise ScreenConnect to maintain access.
Defensive Notes
  • Amazon reported that its cloud infrastructure and customer workloads were not impacted.
  • The article reports Cisco disclosed CVE-2026-20131 on March 4, but provides no specific patch or remediation instructions.

MITRE ATT&CK

T1007 · System Service DiscoveryThe PowerShell script collected information about running services.T1049 · System Network Connections DiscoveryThe PowerShell script collected information about active connections.T1059.001 · PowerShellA PowerShell reconnaissance script collected system and network information.T1059.004 · Unix ShellA Bash script turned compromised Linux servers into HTTP reverse proxies and erased their logs.T1070.002 · Clear Linux or Mac System LogsThe Bash proxy script erased logs on compromised Linux servers every five minutes.T1071.001 · Web ProtocolsA JavaScript RAT communicated with C2 servers over WebSockets.T1074.002 · Remote Data StagingThe script organized collected data in per-host directories on a centralized network share.T1082 · System Information DiscoveryThe PowerShell reconnaissance script collected system information.T1105 · Ingress Tool TransferAfter successful exploitation, the attackers commanded a compromised device to download and execute a Linux binary.T1190 · Exploit Public-Facing ApplicationInterlock exploited CVE-2026-20131 through crafted HTTP requests to affected FMC devices.T1219 · Remote Access ToolsInterlock deployed ConnectWise ScreenConnect, described as a commercial remote desktop tool, to maintain access.T1505.003 · Web ShellThe campaign used a Java webshell that operated in memory, intercepted HTTP requests, and executed encrypted payloads.T1518 · Software DiscoveryThe PowerShell script collected information about installed software.T1560.001 · Archive via UtilityThe attackers compressed collected reconnaissance data into ZIP archives.

CVE

CVE-2026-20131Cisco · Cisco Secure Firewall Management Center (FMC)Amazon’s threat intelligence teams uncovered an Interlock ransomware campaign exploiting a zero-day flaw in Cisco Secure Firewall Management Center (FMC), tracked as CVE-2026-20131.

Threat Actors

InterlockThe article attributes the campaign to the Interlock ransomware group, based on recovered artifacts including a ransom note and a TOR-based negotiation portal.

Malware

InterlockAmazon’s threat intelligence teams uncovered an Interlock ransomware campaign exploiting a zero-day flaw in Cisco Secure Firewall Management Center (FMC), tracked as CVE-2026-20131.

Vendors

AmazonAmazon’s threat intelligence teams uncovered an Interlock ransomware campaign exploiting a zero-day flaw in Cisco Secure Firewall Management Center (FMC), tracked as CVE-2026-20131.CiscoAmazon’s threat intelligence teams uncovered an Interlock ransomware campaign exploiting a zero-day flaw in Cisco Secure Firewall Management Center (FMC), tracked as CVE-2026-20131.ConnectWiseThe attackers’ toolkit included multiple RATs (JavaScript and Java), reconnaissance PowerShell scripts, reverse-proxy log erasure, and commercial tools like ConnectWise ScreenConnect to maintain access.

Products

Cisco Secure Firewall Management CenterAmazon’s threat intelligence teams uncovered an Interlock ransomware campaign exploiting a zero-day flaw in Cisco Secure Firewall Management Center (FMC), tracked as CVE-2026-20131.ConnectWise ScreenConnectThe attackers’ toolkit included multiple RATs (JavaScript and Java), reconnaissance PowerShell scripts, reverse-proxy log erasure, and commercial tools like ConnectWise ScreenConnect to maintain access.

Tools

Amazon MadPotAmazon MadPot honeypots captured crafted HTTP requests, a memory-resident Java webshell, and verification mechanisms used by the attackers.CertifyOther tools found in the attack environment include Volatility, typically used for memory forensics, and Certify, an offensive security tool targeting Active Directory Certificate Services.volatilityOther tools found in the attack environment include Volatility, typically used for memory forensics, and Certify, an offensive security tool targeting Active Directory Certificate Services.

Industries

ConstructionThe education sector has been the most affected, followed by engineering, construction, manufacturing, healthcare, and public sector organizations.EducationInfrastructure was organized by target for tool distribution and data collection, with targeting focused on education and critical industries and operator activity consistent with a UTC+3 time zone.EngineeringThe education sector has been the most affected, followed by engineering, construction, manufacturing, healthcare, and public sector organizations.HealthcareThe education sector has been the most affected, followed by engineering, construction, manufacturing, healthcare, and public sector organizations.ManufacturingThe education sector has been the most affected, followed by engineering, construction, manufacturing, healthcare, and public sector organizations.Public SectorThe education sector has been the most affected, followed by engineering, construction, manufacturing, healthcare, and public sector organizations.

Related Articles