Interlock Ransomware Exploits Cisco FMC Zero-Day for Root Access

Interlock exploited a zero-day in Cisco Secure Firewall Management Center (CVE-2026-20131) to execute arbitrary Java code as root. AWS threat intelligence observed exploitation beginning Jan 26, 2026, 36 days before Cisco’s March 4 disclosure. A misconfigured Interlock server exposed the group’s multi-stage toolkit and indicators.

Part of the PlainSec briefing for 2026-03-25

Sources

• BleepingComputer
• AWS Security Blog
• The Hacker News
• Fortinet Outbreak Alerts
• SecurityWeek
• Infosecurity Magazine
• The Hacker News
• The Record from Recorded Future