High

Analysis Summary

The Interlock ransomware group is actively exploiting a critical zero-day vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC), enabling unauthenticated remote attackers to execute arbitrary Java code with root privileges. A researcher discovered that Interlock began exploiting this flaw on January 26, 2026 36 days before Cisco publicly disclosed it on March 4, 2026 giving the group a significant advantage to compromise organizations undetected. Initial attack activity included HTTP requests targeting vulnerable software paths, delivering Java code execution attempts and configuration data, confirmed by HTTP PUT requests uploading generated files. Researchers were able to simulate compromised systems, prompting the deployment of a malicious Linux ELF binary.

Exposed infrastructure revealed Interlock’s operational methodology, including the organization of artifacts into dedicated paths for individual targets, streamlining both tool deployment and data exfiltration. Technical indicators confirm the activity aligns with Interlock’s ransomware family, which emerged in September 2024. The recovered ELF binaries, embedded ransom notes, and TOR negotiation portals match the group’s established double-extortion model, leveraging regulatory exposure language to pressure victims. Temporal analysis suggests the actors operate in the UTC+3 timezone, with historical targeting focused on sectors like education, healthcare, construction, manufacturing, engineering, and government, where disruption creates urgency for ransom payment.

Once inside a network, Interlock employs a multi-layered toolkit to escalate privileges and maintain persistence. A recovered PowerShell script performs extensive Windows environment enumeration, collects system information, browser artifacts, and network connections, and organizes results into host-specific directories for eventual compression into ZIP archives, signaling preparation for organization-wide encryption. The group uses custom remote access trojans in JavaScript and Java, with the former leveraging Windows Management Instrumentation and persistent RC4-encrypted WebSocket connections, and the latter built on GlassFish libraries for redundant access. Linux servers are configured via Bash scripts as HTTP reverse proxies using HAProxy, with aggressive log deletion every five minutes to obscure attacker activity.

Interlock further employs a fileless, memory-resident Java webshell for command execution, AES-128 encrypted communications, and abuses legitimate tools such as ConnectWise ScreenConnect, Volatility, and Certify alongside custom malware. Due to heavy customization of artifacts per target, traditional signature-based detection using file hashes is largely ineffective. Organizations operating Cisco Secure Firewall Management Center must urgently apply the latest patches. Defenders should focus on behavioral analysis, identifying memory-resident anomalies, and monitoring network reconnaissance and operational patterns unique to Interlock’s multi-stage attack chain.

Impact

• Sensitive Data Theft
• Code Execution
• Gain Access
• Double Extortion

Indicators of Compromise

SHA1

Remediation

• Apply the latest security updates for Cisco Secure Firewall Management Center (FMC) to address CVE-2026-20131.
• Look for unusual HTTP requests to FMC paths, unexpected file uploads (HTTP PUT requests), and memory-resident anomalies.
• Since Interlock customizes malware per target, rely on behavioral analysis, not file hashes, for detection.
• Identify patterns of scanning, host enumeration, and unusual WebSocket or HTTP traffic that may indicate ongoing attacks.
• Monitor for unexpected PowerShell activity, Active Directory exploitation attempts, and abnormal system configuration changes.
• Enable endpoint detection and response (EDR) tools to detect in-memory webshells, Java/JavaScript implants, and unauthorized reverse proxy configurations.
• Ensure regular backups of critical data are isolated, tested, and resistant to ransomware encryption.
• Monitor and restrict legitimate administrative tools (e.g., ConnectWise ScreenConnect) to prevent abuse by attackers.
• Prepare an incident response plan focused on ransomware, including rapid isolation of compromised systems and secure evidence collection.
• Ensure logs are centralized and immutable to prevent attackers from erasing traces; consider monitoring for frequent HAProxy log deletions.