Threat video1:00
Qilin Exploits Cisco FMC CVE-2026-20079: Detection & IOCs
Qilin affiliate UAT-11988 pivots via Cisco FMC CVE-2026-20079 to deploy ransomware. Patch status, 21 IOCs and 9 detection rules, plus a free Splunk SPL query.
Read the full threat intel for Qilin Exploits Cisco FMC CVE-2026-20079: Detection & IOCs →
Chapters
- 0:00The hookFive flaws exploited in one week.
- 0:04The storyClusters exploited Cisco's firewall manager.
- 0:11Attack pathAn unauthenticated bypass came first.
- 0:24AttributionAttributed to Qilin.
- 0:29Indicators of compromise15 indicators to hunt: 5 IPs, 3 SHA-256 hashes and 3 file names, and more.
- 0:38MITRE ATT&CK techniques15 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation5 steps now: Apply Cisco hotfixes.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Five flaws exploited in one week.
0:05Clusters exploited Cisco's firewall manager.
0:08An affiliate then deployed ransomware.
0:11An unauthenticated bypass came first.
0:14Static credentials then stolen logins.
0:17A Qilin affiliate deployed ransomware.
0:19Another cluster planted lasting persistence.
0:25Attributed to Qilin. Confidence: high.
0:2915 indicators to hunt: 5 IPs, 3 SHA-256 hashes and 3 file names, and more.
0:3815 ATT&CK techniques, from initial access to command and control.
0:445 steps now: Apply Cisco hotfixes.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.