Ethical Hacking News
Ransomware criminals have been exploiting a critical Cisco 0-day vulnerability weeks before its public disclosure, demonstrating the cunning and speed at which these operators can operate. The attack highlights the importance of staying vigilant and proactive in defense strategies against modern ransomware attacks.
A critical Cisco 0-day vulnerability (CVE-2026-20131) has been exploited by Interlock, allowing arbitrary Java code execution as root on vulnerable devices. Interlock began exploiting the vulnerability 36 days before its public disclosure, starting January 26. The exploit allows an unauthenticated remote attacker to execute malicious code, potentially leading to sensitive data exposure and system compromise. Amazon's MadPot honeypot network played a crucial role in detecting Interlock's activities by logging exploit traffic tied to their infrastructure. Interlock's attack toolkit includes custom RATs that maintain persistent access to compromised machines, collecting additional information using PowerShell and Windows Management Instrumentation. The attackers also deployed legitimate software to blend their traffic with authorized remote access tools, highlighting the complexity of modern ransomware attacks. Amazon is urging customers to upgrade as soon as possible due to the critical nature of this vulnerability.
Amazon has revealed that ransomware criminals, specifically Interlock, have been exploiting a critical Cisco 0-day vulnerability just weeks before its public disclosure. The exploit, CVE-2026-20131, allows an unauthenticated, remote attacker to execute arbitrary Java code as root on vulnerable devices, making it a maximum-severity bug.
According to Amazon security boss CJ Moses, Interlock began exploiting this vulnerability 36 days before its public disclosure, starting January 26. This early exploitation highlights the cunning and speed at which ransomware operators can operate, often staying one step ahead of security teams until patches are available.
The critical flaw in Cisco Secure Firewall Management Center software allows an attacker to inject malicious code into the system, potentially leading to arbitrary Java code execution as root on vulnerable devices. This would grant access to sensitive data and enable the attackers to execute malicious commands on the compromised device.
Amazon's MadPot honeypot network played a crucial role in detecting Interlock's activities. The honeypot network logged exploit traffic tied to Interlock's infrastructure, providing valuable insights into the attacker's tactics. Additionally, Amazon's security team spotted a misconfigured infrastructure server that exposed Interlock's attack toolkit.
The attack toolkit, designed by Interlock, includes a PowerShell script that scoops up information about victims' Windows environments, such as operating system and hardware details; running services; installed software; storage configuration; Hyper-V virtual machine inventory; user file listings across Desktop, Documents, and Downloads directories; and RDP authentication events from Windows event logs. The script compresses this data into ZIP archives named for each host.
Furthermore, Interlock's toolkit includes custom remote access trojans (RATs) that maintain persistent access to compromised machines. These RATs use JavaScript implants to override browser console methods, hiding from malware-detection tools, and collect additional information about the infected host using PowerShell and Windows Management Instrumentation.
The attackers also deployed legitimate software to blend their traffic with authorized remote access tools. This includes ConnectWise ScreenConnect for remote desktop control; open-source memory forensics tool Volatility; and Certify, another open-source offensive security tool used by red teams to exploit misconfigurations in Active Directory Certificate Services (AD CS).
Amazon's attribution of the malicious activity to Interlock was based on an ELF binary, embedded ransom note, and TOR negotiation portal, among other artifacts. The ransom note threatened to expose victims to regulators, using the pressure of fines and compliance violations – in addition to data encryption and leaks – to solicit payment.
The use of legitimate software by Interlock highlights a tactic employed by ransomware operators: deploying multiple redundant remote access mechanisms to maintain access even if individual footholds are removed. This approach underscores the complexity and adaptability of modern ransomware attacks, making it essential for security teams to stay vigilant and proactive in their defense strategies.
In light of this revelation, Amazon is urging customers to upgrade as soon as possible and reference its security advisory for more details and guidance.
Related Information:
https://www.ethicalhackingnews.com/articles/Ransomware-Exploitation-A-Masterclass-in-Malicious-Deception-ehn.shtml
https://go.theregister.com/feed/www.theregister.com/2026/03/18/amazon_cisco_firewall_0_day_ransomware/
https://www.theregister.com/2026/03/18/amazon_cisco_firewall_0_day_ransomware/
https://cybersecuritynews.com/cisco-firewall-0-day-ransomware/
https://nvd.nist.gov/vuln/detail/CVE-2026-20131
https://www.cvedetails.com/cve/CVE-2026-20131/
https://www.fortinet.com/blog/threat-research/interlock-ransomware-new-techniques-same-old-tricks
https://www.bleepingcomputer.com/news/security/ai-generated-slopoly-malware-used-in-interlock-ransomware-attack/
Published: Thu Mar 19 15:33:21 2026 by llama3.2 3B Q4_K_M
