Interlock Ransomware Hits Cisco FMC Zero-Day: Lessons for SOCs on Edge Device Security

Your firewall could be the entry point. A critical Cisco FMC zero-day is being used in real-world ransomware attacks, turning security tools into launchpads. 

In this episode, we cover what’s happening, how attackers are exploiting edge devices, and how SOC teams can stay ahead.

Transcript

SPEAKER_00 0:02

Good morning, good afternoon, or good evening, whenever you may be, and welcome to another episode of the SOC Brief. This is your go-to podcast for staying ahead of the ever-evolving world of cybersecurity threats. I'm your host Andrew, and today we're going to discuss a new Zero Day that's being actively exploited by ransomware groups. That'll be CVE 2026-20131, which is a critical remote code execution flaw in Cisco's Secure Firewall Management Center, also known as their FMC. This one was weaponized by the Interlock Ransomware Group as far back as late January of this year. So this is well over a month before Cisco even disclosed it. We'll kind of unpack what happened, why it's a big deal for anyone running firewalls or edge devices, and the exact steps your SOC should take right now to avoid becoming the next victim. So discuss the trend in the Cisco FMC exploitation. If you don't know what a the Cisco FMC is, it is a centralized management location, or it's the central brain for managing many enterprise firewalls. The vulnerability is an insecure deserialization flaw that lets an unauthenticated remote attacker run arbitrary Java code as root, and this requires no login. The score on it is a 10.0 on the CVSS, and Amazon Threat Intelligence spotted Interlock using it in the wild starting in late January, as we previously discussed. So this is well before the public advisory on March 4th. The attacker sent crafted HTTP requests, gained root access, dropped tools, and even moved toward ransomware deployment. The attackers are targeting the FMCs as they're often internet exposed for remote management, sit at the edge of the network, and controls the very devices meant to stop the attacks. Once compromised, the attackers can reconfigure the firewalls, pivot deeper, or use the device as a launch pad for further attacks. And it's important to remember that the attackers had a full month head start while defenders were in the dark with this one. Interlock, which is a Russian linked group, used it to drop reconnaissance scripts, reverse proxies, and ransomware payloads. And this fits the pattern we've seen with other edge devices. Once they are inside the management console, the whole perimeter becomes theirs. For SOCs, it'll be a reminder that even security tools can become the weakest linked when left unpatched or exposed. So if you're running FMCs in your environment, detection is going to start by monitoring for any anomalous HTTP posts to the FMC management interfaces, unexpected root level activity, or new proxy configurations on the firewall appliance itself. Look for the known IOCs that Amazon and Cisco have published. These will be specific request patterns, dropped ELF binaries, and unusual outbound connections. A critical step here is going to be blocking or access controlling management access to the FMC from the public internet. Restrict it to trusted management IPs or VPNs only. And if you can't patch immediately, enable additional logging and alerting on any changes to firewall rules or the admin accounts. This one is unfortunately one we see pretty frequently where management access is typically left open to the internet. And that's just for ease of management and not really realizing that you're leaving it open for attackers as well. For proactive hunting, search your firewall logs for the specific CVE indicators. Review recent admin logins and scan for any rogue accounts or processes. Check your threat intel feeds. SISA has already added the CVE to the known exploded vulnerabilities catalog, so treat it as a priority. Make sure you're briefing your network and security teams. Things like review all edge management consoles for exposure and patch status. You can also run a quick tabletop on what happens if our firewall console or our firewall is compromised. The bottom line here is that the interlock campaign shows the attackers are hunting management interfaces aggressively, and that's not anything new. Socks that will treat their edge devices as high value targets and enforce strict access controls can stop these attacks cold. Here's some closing thoughts on this one. The Cisco FMC0 Day being turned into a ransomware launch pad is another reminder that even security tools need constant vigilance. Attackers aren't going to wait for patch Tuesday. They move the moment they find a door. But the socks that patch quickly, restrict exposure, and hunt proactively can help keep the bad guys out. This week, I say do a quick audit of any exposed management consoles in your environments. Make sure you're checking things like your firewalls and load balancers, and verify that they're patched or properly firewalled and access controlled. Share the results with your team. If you can find a potential risk and correct it before it becomes an issue, that's a big win. And that's a wrap for this episode of the SOC Brief. If you have questions or your own edge device stories, hit us up on social media or via our website. Keep your eyes open, keep sharpening those skills, and we'll talk soon. Stay secure out there. Bye.