Ransomware - Interlock Exploits Cisco Zero-Day Vulnerability
Basically, a ransomware group found a serious flaw in Cisco firewalls before it was fixed, putting many organizations at risk.
A serious Cisco firewall vulnerability was exploited by the Interlock ransomware group weeks before a patch was released. This poses a major risk to many organizations. Security teams need to act fast to protect their systems from potential compromise.
What Happened
In a startling revelation, Amazon has uncovered that the Interlock ransomware group exploited a critical vulnerability in Cisco's firewall software, specifically CVE-2026-20131. This flaw, a remotely exploitable deserialization issue, was rated with a maximum CVSS score of 10. The exploitation began on January 26, 2026, a full 38 days before Cisco released a patch on March 4, 2026. This timeline transforms the situation from an urgent patching scenario to a serious zero-day vulnerability emergency.
Amazon's analysis was prompted by Cisco's advisory, leading them to utilize their MadPot global network—a honeypot system designed to detect such exploits. The findings revealed that Interlock had a significant head start, compromising organizations before defenders were even aware of the vulnerability's existence.
Who's Being Targeted
The Interlock group, which emerged in 2024, has previously targeted various sectors, including education, healthcare, and government. Their ability to exploit a zero-day vulnerability in a widely used firewall system like Cisco's means that any organization using affected versions of the Cisco Secure Firewall Management Center could be at risk. The potential for widespread impact is significant, as many organizations may not yet be aware of this critical flaw.
Signs of Infection
Indicators of compromise include unusual HTTP requests directed at specific paths within the affected software. Amazon's honeypot was able to capture a malicious binary from the attackers, revealing the full attack chain used by Interlock. Security teams should be vigilant for any anomalies in their logs, especially those related to the identified IP addresses and malicious domains associated with this ransomware group.
How to Protect Yourself
Organizations are urged to patch their Cisco firewall systems immediately to mitigate the risk posed by CVE-2026-20131. Cisco recommends using its software checker to determine the appropriate updates based on the version of the FMC software in use. Additionally, implementing a defense-in-depth strategy is crucial, as zero-day exploits can bypass even the most diligent patching efforts. Regular monitoring for signs of compromise and maintaining updated security protocols can help safeguard against such vulnerabilities in the future.
CSO Online