Cisco Talos Links FMC Flaw Exploitation to Qilin, Cyclops Blink and Credential Theft
Summary
Cisco Talos says three threat clusters exploited CVE-2026-20079 and CVE-2026-20316 in Cisco FMC devices, deploying Qilin ransomware, Cyclops Blink, web shells and credential-theft tools. Cisco released hot fixes and urges customers to install them.
Key points
- UAT-11988 accessed an FMC device using static credentials, gathered network and account data, established proxy and tunnel access, and ultimately deployed Qilin ransomware.
- UAT-11823 used one or both flaws to install a Netcat reverse shell and a Cyclops Blink variant; Talos says its tooling overlaps with Sandworm.
- UAT-12197 exploited CVE-2026-20079 to deploy a JSP web shell and malicious JAR file used to execute commands and steal authentication data.
- CVE-2026-20079 enables unauthenticated remote attackers to bypass authentication and execute scripts as root; CVE-2026-20316 allows login with static low-privileged credentials.
- Cisco released hot fixes for both vulnerabilities and urged customers to install them; a broader hardening release was planned for the following week.
Article Details
- Attack Vectors
- Attackers exploited CVE-2026-20079 to bypass authentication and execute scripts as root on vulnerable Cisco Secure Firewall Management Center devices.
- Attackers used static low-privileged credentials associated with CVE-2026-20316 to access FMC devices.
- Post-compromise activity included deploying web shells and malicious JAR files, stealing credentials, establishing reverse shells and proxies, and deploying ransomware or malware.
- Defensive Notes
- Cisco released hot fixes for both vulnerabilities and urged customers to install them immediately.
- Cisco said a more comprehensive hardening release, including patches for additional vulnerabilities, was planned for the following week.
MITRE ATT&CK
T1059.004 · Unix ShellUAT-11823 established a Netcat-based reverse shell and executed the malicious license file as root.T1078 · Valid AccountsAttackers used static low-privileged credentials associated with CVE-2026-20316 to log in to FMC devices.T1090 · ProxyUAT-11988 deployed a Python SOCKS5 proxy to maintain access to internal systems.T1190 · Exploit Public-Facing ApplicationThe clusters exploited CVE-2026-20079 and CVE-2026-20316 to gain access to Cisco FMC devices.T1505.003 · Web ShellUAT-12197 deployed a JSP-based web shell in the Cisco Security Manager Tomcat webroot.T1572 · Protocol TunnelingUAT-11988 used a reverse SSH tunnel and forwarded ports for internal services.
CVE
Threat Actors
SandwormTalos said UAT-11823's tooling overlaps with Sandworm; the article describes Sandworm as a Russian state-sponsored group and attributes Cyclops Blink to it.UAT-11823Talos tracked this cluster as exploiting both FMC vulnerabilities; its tooling overlaps with the Sandworm APT group.UAT-11988Talos attributed this cluster with high confidence to Qilin ransomware affiliates.UAT-12197Talos tracked this cluster as exploiting CVE-2026-20079 and deploying a JSP web shell and malicious JAR to steal authentication data.
Malware
Vendors
Products
Cisco Secure Firewall Management CenterCisco Talos says three threat clusters exploited two newly patched Cisco Secure Firewall Management Center flaws, leading to web shells, credential theft, reverse shells, and proxy deployment.Cisco Security ManagerThe third cluster, tracked as UAT-12197, exploited CVE-2026-20079 and deployed a JSP-based web shell into the Cisco Security Manager Tomcat webroot directory.
Tools
ImpacketAfter reconnaissance, the threat actor used post-exploitation tools including Impacket, Invoke-TheHash, and custom EDR killers.Invoke-TheHashAfter reconnaissance, the threat actor used post-exploitation tools including Impacket, Invoke-TheHash, and custom EDR killers.netcatAfter gaining access, the threat actors modified a license.tmp file to establish a Netcat-based reverse shell connecting to their command-and-control infrastructure.