Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access

Amazon Threat Intelligence has exposed an active Interlock ransomware campaign exploiting CVE-2026-20131, a critical zero-day in Cisco Secure Firewall Management Center (FMC).

• •CVE-2026-20131 (CVSS 10.0) is an insecure Java deserialization flaw allowing unauthenticated remote attackers to execute arbitrary code as root.
• •The zero-day was actively exploited since January 26, 2026, over a month before Cisco's public disclosure.
• •Interlock's toolkit includes custom JavaScript/Java RATs, a memory-resident web shell, PowerShell reconnaissance scripts, and an HAProxy-based reverse proxy for infrastructure laundering.
• •Aggressive log erasure runs every five minutes via cron job, and ConnectWise ScreenConnect is used for persistent remote access.
• •