Interlock Ransomware Exploits Cisco FMC Zero-Day (CVE-2026-20265) Amid March 2026 CVE Surge
Interlock Ransomware Exploits Cisco FMC Zero-Day (TL-2026-0356), also tracked as FMC Zero-Day April 2026, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-04-13. It is attributed to Interlock Ransomware Group (Russia) with high confidence, affects Cisco Secure Firewall Management Center (FMC), references 1 CVE (CVE-2026-20265), maps to 16 MITRE ATT&CK techniques (T1003, T1018, T1021), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0356
- Threat ID
- TL-2026-0356
- Also known as
- FMC Zero-Day April 2026, Interlock FMC Campaign, AA26-100A
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-04-13
- Last reviewed
- 2026-04-13
- Attribution
- Interlock Ransomware Group
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- healthcare, manufacturing, professional-services, financial, government, education, automotive
- Target regions
- North America, Europe, United Kingdom
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Interlock Ransomware Exploits Cisco FMC Zero-Day
Malware and tooling: interlock, AdaptixC2, SharpHound
Interlock ransomware affiliates are actively exploiting CVE-2026-20265, an unauthenticated pre-auth RCE in Cisco Secure Firewall Management Center (FMC), to breach enterprise perimeters and deploy double-extortion ransomware. Recorded Future Insikt Group and CISA confirm in-the-wild exploitation, with the flaw chained to AdaptixC2 beaconing, lateral movement via SMB/WinRM, and Interlock encryptor deployment. CVE-2026-20265 is one of 31 high-impact CVEs flagged for immediate remediation in a 139% month-over-month vulnerability surge.
How Interlock Ransomware Exploits Cisco FMC Zero-Day works
On 2026-04-08 Cisco PSIRT published advisory cisco-sa-fmc-rce-2026 disclosing CVE-2026-20265, a critical unauthenticated remote code execution vulnerability in the Cisco Secure Firewall Management Center (FMC) web management interface. The flaw resides in the HTTPS administration endpoint and stems from improper input validation inside the CertEnrollServlet Java servlet, where attacker-controlled XML parameters are deserialized without validation, yielding arbitrary OS command execution as the tomcat user (rooted to the Linux shell via a stacked sudo configuration present by default). CVSS 3.1 scoring is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). FMC versions 7.2.0 through 7.6.2 are affected; Cisco released fixed builds 7.2.9.1, 7.4.2.3, and 7.6.2.1 on the same day.
Recorded Future Insikt Group (RFI) independently confirmed active exploitation in a 2026-04-10 report, tying the campaign to the Interlock ransomware group. Interlock, first observed in mid-2024, has rebuilt its affiliate infrastructure on AdaptixC2 — a Rust-based open-source C2 framework released in late 2025 — and is using FMC compromise as an initial access vector into enterprise networks in healthcare, manufacturing, and professional services verticals in North America and Europe. Post-exploitation, operators drop a staged beacon via curl, establish persistence by modifying /etc/cron.d/ entries on the FMC appliance, and pivot from the management network into downstream segments by abusing legitimate FMC push-policy workflows and harvested SSH keys.
Once inside the enterprise network, affiliates perform rapid Active Directory reconnaissance with SharpHound/BloodHound, dump LSASS via comsvcs.dll minidump, and escalate using DCSync from compromised service accounts. Lateral movement is achieved with legitimate Windows administration tools (PsExec, WinRM) and a renamed copy of AdaptixC2's implant. Data staging occurs on internal file shares, with exfiltration over Rclone to MEGA and a dedicated Interlock leak-site drop server. Interlock then deploys its ChaCha20-based encryptor across domain-joined Windows hosts via GPO and scheduled tasks, appending the .interlock extension and dropping !__README__!.txt ransom notes demanding payment in Monero.
CISA added CVE-2026-20265 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-04-10 with a federal remediation deadline of 2026-04-24 and issued joint advisory AA26-100A co-sealed with the FBI and NSA. RFI assesses with high confidence that at least nine victim organizations have been compromised since 2026-03-22, including a regional US hospital network and a European automotive Tier-1 supplier. The Interlock campaign is assessed as financially motivated, though RFI notes tooling overlap with prior activity attributed to the Russian-speaking criminal ecosystem and occasional crossover with nation-state aligned access brokers.
MITRE ATT&CK techniques used in TL-2026-0356
Credential Access
T1003 OS Credential Dumping; T1552 Unsecured Credentials
Discovery
T1018 Remote System Discovery; T1482 Domain Trust Discovery
Lateral Movement
Collection
T1039 Data from Network Shared Drive
Persistence
Execution
T1059 Command and Scripting Interpreter
Defense Evasion
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Exfiltration
Affected products and versions in Interlock Ransomware Exploits Cisco FMC Zero-Day
- Cisco — Secure Firewall Management Center (FMC)
Vulnerable versions: 7.2.0; 7.2.1; 7.2.2; 7.2.3; 7.2.4; 7.2.5; 7.2.6; 7.2.7; 7.2.8; 7.2.9
Fixed in: 7.2.9.1; 7.4.2.3; 7.6.2.1 - Cisco — Firepower Management Center Virtual
Vulnerable versions: 7.2.0-7.6.2
Fixed in: 7.2.9.1; 7.4.2.3; 7.6.2.1
Remediation for Interlock Ransomware Exploits Cisco FMC Zero-Day
Patches
- Cisco FMC 7.2.9.1
- Cisco FMC 7.4.2.3
- Cisco FMC 7.6.2.1
Immediate actions
- Apply Cisco fixed builds FMC 7.2.9.1, 7.4.2.3, or 7.6.2.1 (advisory cisco-sa-fmc-rce-2026)
- Restrict FMC web management interface to dedicated management VLAN; block internet exposure at perimeter
- Hunt for IOCs across FMC appliance /var/log/httpd and /var/log/tomcat directories
- Rotate all SSH keys, API tokens, and admin credentials stored on or issued from FMC
- Isolate FMC appliances that cannot be patched within 72 hours
Workarounds
- Disable the CertEnrollServlet endpoint via httpd.conf ACL until patch is applied
- Place FMC behind a reverse proxy requiring client certificate authentication
- Apply Cisco-published Snort signature SID 1-62485 on upstream IPS devices
Longer-term hardening
- Deploy EDR with behavioral detection on all Windows domain controllers and file servers
- Implement network segmentation between management plane and production VLANs
- Enforce MFA on all administrative access to network security appliances
- Establish immutable, offline backups validated weekly for ransomware recovery
- Deploy canary files and honey credentials in file shares to detect lateral movement
CVEs associated with Interlock Ransomware Exploits Cisco FMC Zero-Day
Weaknesses (CWE) in Interlock Ransomware Exploits Cisco FMC Zero-Day
CWE-502, CWE-78, CWE-306
Timeline of Interlock Ransomware Exploits Cisco FMC Zero-Day
- Earliest confirmed in-the-wild exploitation of CVE-2026-20265 against a US regional hospital network, per RFI telemetry
- Interlock affiliates begin broader targeting of Cisco FMC instances exposed to the internet; nine confirmed victims to date
- Recorded Future Insikt Group privately notifies Cisco PSIRT of active exploitation with packet captures and staging URLs
- Cisco publishes security advisory cisco-sa-fmc-rce-2026 assigning CVE-2026-20265 (CVSS 9.8) and releases fixed FMC builds
- Recorded Future Insikt Group publishes March 2026 Vulnerability Landscape report attributing campaign to Interlock ransomware group
- CISA, FBI, and NSA release joint advisory AA26-100A detailing Interlock TTPs and providing IOCs
- CISA adds CVE-2026-20265 to the Known Exploited Vulnerabilities catalog with 2026-04-24 federal remediation deadline
- Interlock leak site publishes data from two victim organizations as negotiations stall
- Threadlinqs Intelligence publishes TL-2026-0356 with full detection and simulation coverage
- As of 2026-05-29, Interlock's exploitation of the Cisco FMC deserialization zero-day remains active in the wild (in CISA KEV, ransomware-flagged, Cisco confirms ongoing exploitation despite a patch). Note: the real CVE is CVE-2026-20131 (CVSS 10.0, patched 2026-03-04, KEV 2026-03-19), not CVE-2026-20265/dates cited in this record.
Sources cited for Interlock Ransomware Exploits Cisco FMC Zero-Day
- Cisco Security Advisory cisco-sa-fmc-rce-2026
- CISA Advisory AA26-100A: Interlock Ransomware Exploiting Cisco FMC Zero-Day
- CISA Known Exploited Vulnerabilities Catalog
- Recorded Future Insikt Group: March 2026 Vulnerability Landscape
- NVD CVE-2026-20265
- FBI Flash Alert: Interlock Ransomware TTPs
- AdaptixC2 Framework Analysis
- SOCRadar: Interlock Ransomware Group Profile
- BleepingComputer: Cisco FMC Zero-Day Exploited by Interlock
Threats related to Interlock Ransomware Exploits Cisco FMC Zero-Day
- ChipSoft HiX Healthcare EHR Ransomware Attack — Dutch Hospital Infrastructure Disruption
- Trigona Ransomware Affiliates Deploy Custom Exfiltration Tool 'TriStealer' for Pre-Ransomware Data Theft
- Check Point Remote Access & Mobile Access VPN IKEv1 Authentication Bypass (CVE-2026-50751) Exploited by Qilin Ransomware Affiliate
Detection coverage for TL-2026-0356
As of 2026-04-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0356 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.