A newly uncovered ransomware campaign highlights one of the most dangerous realities in cybersecurity:
Attackers are exploiting vulnerabilities before organizations even have a chance to patch them.
According to research from AWS, the Interlock ransomware group has been actively exploiting a critical Cisco firewall vulnerability (CVE-2026-20131) for weeks before it was publicly disclosed.
The vulnerability
- CVE-2026-20131
- CVSS Score: 10.0 (Critical)
- Affects: Cisco Secure Firewall Management Center (FMC)
- Impact:
👉 Remote, unauthenticated attackers can execute arbitrary Java code as root
The flaw stems from insecure deserialization, allowing attackers to send crafted Java objects to vulnerable systems.
Cisco disclosed the issue on March 4, but evidence shows exploitation began as early as January 26 — confirming it was a true zero-day in the wild.
Target: Internet-facing firewalls
The campaign focuses on firewall management interfaces, which are:
- Internet-accessible
- High-value targets
- Often under-monitored
Cisco confirmed that:
- FMC and Security Cloud Control (SCC) are affected
- ASA and FTD are NOT impacted
Inside the Interlock attack chain
AWS researchers gained rare insight into the attacker’s toolkit after discovering a misconfigured Interlock infrastructure server.
This exposed a full multi-stage attack chain, including:
1. Initial Access
- Exploitation of the zero-day vulnerability
2. Reconnaissance
- PowerShell scripts to map the environment
- Data collection from compromised systems
3. Persistence
- Deployment of remote access trojans (RATs)
- JavaScript and Java-based backdoors
- Memory-resident malware to evade detection
4. Evasion & Resilience
- Multiple backdoors for redundancy
- Legitimate remote tools as fallback access
- Relay infrastructure to hide the attacker's origin
5. Final Stage
- Ransomware deployment + data exfiltration (double extortion)
Why this attack matters
This campaign is not just about one vulnerability.
It highlights a fundamental problem:
Even perfect patching cannot protect against zero-days.
As AWS CISO CJ Moses noted:
- Attackers had weeks of unrestricted access
- Traditional defenses were ineffective during that window
- The combination of zero-day + advanced tooling is what makes this dangerous
Firewalls: a growing attack surface
Recent data shows:
- 17% of exploited vulnerabilities target edge devices like firewalls and VPNs
- Firewall compromise is often the initial entry point in ransomware attacks
Why attackers love firewalls:
- 🌐 Internet-facing by design
- 🧩 Complex, often proprietary software
- 🔄 Ideal pivot point for lateral movement
- ⚠️ Frequently under-maintained
How to defend against zero-day threats
Since zero-days cannot be patched in advance, organizations must rely on defense in depth:
1. Restrict access to management interfaces
- Never expose firewall management to the public internet
2. Monitor aggressively
- Detect unusual behavior on edge devices
- Watch for unexpected outbound connections
3. Segment your network
- Prevent attackers from moving laterally
4. Apply patches immediately
- Once available, prioritize critical infrastructure updates
5. Use layered security controls
- EDR, NDR, logging, and anomaly detection
Key takeaway
This campaign reinforces a critical cybersecurity truth:
Security is not about a single control — it’s about layers.
When attackers exploit zero-days, your only protection is how well your defenses overlap.
