# Interlock Ransomware: Cisco FMC Zero-Day Exploitation Campaign

- **Artifact ID:** CHQ-EX-2026-013
- **Public record:** https://record.cybersecurityhq.com/exhibits/chq-ex-2026-013
- **Machine-record SHA-256:** `6727b111d6d62570a6d7b21a76889a5b2475e4f12b2523af115d76c08a46211f`

## Complete structured record

```json
{
  "id": "CHQ-EX-2026-013",
  "title": "Interlock Ransomware: Cisco FMC Zero-Day Exploitation Campaign",
  "subtitle": "Ransomware group exploited Cisco Secure Firewall Management Center as a zero-day for 36 days before public disclosure, demonstrating management plane compromise as a deterministic control acquisition pathway with full post-exploitation toolchain including credential theft, certificate abuse, and infrastructure laundering.",
  "classification_notice": [
    "This document is published as a CHQ Exhibit. It records historical conditions, breach events, and industry practices as they existed during the periods described. This Exhibit records observed conditions, exploitation mechanics, and structural patterns as documented in public disclosures, security research publications, and vendor advisories during the stated period.",
    "This document does not address present conditions and carries no current applicability. No evaluation of past practices is intended or implied.",
    "CHQ Exhibits are not superseded by later artifacts unless explicitly invalidated for factual error."
  ],
  "metadata": {
    "artifact_class": "EXHIBIT",
    "temporal_scope": "OPERATIONAL (JANUARY–MARCH 2026)",
    "authority_level": "NON-JUDGMENTAL",
    "reliance_status": "CONTEXT_ONLY",
    "update_policy": "ERRATA_ONLY",
    "temporal_start": "2026-01-01",
    "temporal_end": "2026-03-31"
  },
  "sections": [
    {
      "heading": "I. Factual Record",
      "content": [
        "Vulnerability: CVE-2026-20131, CVSS 10.0. Insecure deserialization of user-supplied Java byte stream in Cisco Secure Firewall Management Center (FMC) and Cisco Security Cloud Control (SCC) Firewall Management web-based management interface. Allows unauthenticated, remote attacker to bypass authentication and execute arbitrary Java code as root.",
        "Affected Systems: Cisco Secure Firewall Management Center. Used by organizations to centrally manage Cisco Secure Firewall devices. The management interface controls firewall policy propagation, access rules, logging configuration, and device administration across the managed firewall fleet.",
        "Discovery: Cisco became aware of CVE-2026-20131 after a member of its Advanced Security Initiatives Group found it during internal security testing. Patched in early March 2026.",
        "Zero-Day Exploitation: Amazon Integrated Security, using the MadPot global sensor network, identified threat activity related to CVE-2026-20131 beginning January 26, 2026, predating public disclosure by 36 days. Amazon CISO CJ Moses disclosed findings on March 20, 2026. Observed activity involved HTTP requests to a specific path in the affected software. Request bodies contained Java code execution attempts and two embedded URLs: one delivering configuration data supporting the exploit, and another designed to confirm successful exploitation by causing a vulnerable target to perform an HTTP PUT request and upload a generated file.",
        "Attribution: Interlock ransomware group, attributed with high confidence based on convergent technical and operational indicators including embedded ransom note and TOR negotiation portal.",
        "Exploitation Timeline: January 26, 2026: First observed exploitation activity (Amazon MadPot). Early March 2026: Cisco discloses and patches CVE-2026-20131. March 20, 2026: Amazon CISO publicly discloses zero-day exploitation findings. March 20, 2026: Cisco updates advisory to confirm active exploitation. March 22, 2026: CISA BOD 22-01 remediation deadline for federal agencies.",
        "Post-Exploitation Toolchain (attributed to Interlock campaign): Infrastructure laundering: Bash script configuring Linux servers as HTTP reverse proxies to obscure attacker origins. Installs fail2ban and compiles HAProxy instance listening on port 80, forwarding all inbound HTTP traffic to a hard-coded target IP. Log erasure routine running as cron job every five minutes, deleting and purging *.log files and suppressing shell history by unsetting the HISTFILE variable. Memory-resident web shell: Inspects incoming requests for specially crafted parameters containing encrypted command payloads, which are decrypted and executed in memory. No file written to disk during command execution. Network beacon: Lightweight beacon for phoning attacker-controlled infrastructure to validate successful code execution or confirm network port reachability following initial exploitation. Persistent remote access: ConnectWise ScreenConnect deployed for persistent remote access and as alternative pathway should other footholds be detected and removed. Memory forensics: Volatility Framework, an open-source memory forensics tool, used to parse memory dumps and access sensitive data including credentials. Certificate abuse: Certify, an open-source offensive security tool, used to exploit misconfigurations in Active Directory Certificate Services (AD CS) and identify vulnerable certificate templates and enrollment permissions that allow requesting authentication-capable certificates."
      ]
    },
    {
      "heading": "II. Failure Pattern",
      "content": [
        "The Interlock campaign demonstrates management plane compromise as a complete attack pathway from initial access to environment-wide control. The Cisco FMC management interface was exploited without authentication, granting root access to the centralized control point for all managed firewall devices. From this single point of compromise, the attacker could propagate firewall policy changes, modify access rules, suppress logging, and establish persistent access across the managed environment.",
        "The exploitation bypassed identity entirely. No credentials were required. No authentication was circumvented. The management interface accepted crafted input below the identity layer and granted root execution. This is consistent with the structural observation that management plane authority can operate outside identity enforcement under common enterprise configurations.",
        "The 36-day zero-day exploitation window demonstrates the timing asymmetry between management plane exploitation and management plane patching. Management planes are internal, operationally sensitive, and difficult to patch without service disruption. The vulnerability class most dangerous to management planes — unauthenticated remote code execution — is the class least compatible with gradual remediation timelines. Interlock exploited this timing gap systematically.",
        "The post-exploitation toolchain illustrates the deterministic progression from management plane access to environment-wide control: root access → credential harvesting (Volatility) → certificate abuse (Certify for AD CS) → persistent access (ConnectWise ScreenConnect) → evidence destruction (log erasure cron, HISTFILE suppression). Each stage follows deterministically from management plane authority. The attacker did not need to escalate privileges, move laterally through identity boundaries, or compromise additional systems individually. Management plane access provided the authority for all subsequent stages.",
        "The use of ConnectWise ScreenConnect as a persistence mechanism is notable. A remote management tool — itself a management plane — was deployed as a backdoor within an environment compromised through a different management plane. Management plane compromise was both the entry vector and the persistence mechanism.",
        "The certificate abuse via Certify demonstrates that management plane compromise can cascade into identity infrastructure. By exploiting AD CS misconfigurations from a position of root authority on the firewall management plane, the attacker could request authentication-capable certificates, effectively manufacturing identity credentials. This inverts the relationship the competing model assumes: rather than identity being upstream of management plane, management plane access produced identity credentials."
      ]
    },
    {
      "heading": "III. Referenced By",
      "content": [
        "CHQ-ED-2026-013 — Evidence Docket: Management Plane Compromise as Deterministic Control Surface.",
        "CHQ-P-2026-014 — Position: Management Plane Compromise Produces Deterministic Control That Operates Outside Identity Enforcement.",
        "CHQ-P-2026-011 — Position: Deployed Security Tool Presence Cannot Serve as Evidence of Functioning Control (reinforcing — firewall management tool compromised while operationally deployed)."
      ]
    }
  ],
  "closing_statement": "This Exhibit records historical conditions. It carries no present applicability. No evaluative judgment is made about any organization, vendor, security posture, or attribution conclusion.\n\nTemporal scope: January–March 2026. Exhibit issuance date is March 24, 2026. This Exhibit records technical findings as reported by named security research organizations, not as established fact.\n\nSource: Amazon Integrated Security / CJ Moses (MadPot exploitation discovery and timeline), Cisco (advisory and exploitation confirmation), CISA (KEV catalog and BOD 22-01 directive), The Hacker News (compiled reporting), BleepingComputer (compiled reporting). Post-exploitation toolchain details as disclosed by Amazon Integrated Security.",
  "hash_scope": "Full exhibit content body",
  "hash_generated": "2026-03-24"
}
```