Interlock Ransomware Exploited Cisco Firewall Zero-Day for 36 Days Before Anyone Knew

On March 4, 2026, Cisco published a security advisory for CVE-2026-20131, a maximum-severity remote code execution vulnerability in Cisco Secure Firewall Management Center (FMC) Software. The advisory carried a CVSS score of 10.0 — the highest possible rating — and warned that an unauthenticated, remote attacker could exploit it to execute arbitrary Java code as root on any affected device.

What Cisco did not initially disclose was that the vulnerability had already been in active use for more than five weeks. The Interlock ransomware group had been exploiting it since January 26, 2026, a full 36 days before any patch existed and before any defender anywhere in the world knew to look for it. That information came not from Cisco, but from Amazon.

How Amazon Caught Interlock in the Act

After Cisco's March 4 disclosure, Amazon's threat intelligence team began researching CVE-2026-20131 using Amazon MadPot — a global network of honeypot servers designed to attract and monitor real-world cybercriminal activity. The purpose was to find out whether anyone was exploiting the vulnerability in the wild.

They found Interlock had already been doing exactly that for over a month.

"This wasn't just another vulnerability exploit; Interlock had a zero-day in their hands, giving them a week's head start to compromise organizations before defenders even knew to look. Upon making this discovery, we shared our findings with Cisco to help support their investigation and protect customers."

— CJ Moses, CISO, Amazon Integrated Security (AWS Security Blog, March 18, 2026)

Amazon shared its findings with Cisco to support their investigation, and Cisco subsequently updated its security advisory to reflect the active exploitation. In a statement reported by BleepingComputer, Cisco acknowledged the collaboration and strongly urged all customers to upgrade as soon as possible, confirming the advisory had been updated with the latest findings.

The regulatory response was swift. On March 19, 2026 — one day after Amazon's disclosure — CISA added CVE-2026-20131 to its Known Exploited Vulnerabilities (KEV) catalog, formally designating it as known to be used in ransomware campaigns. Under Binding Operational Directive 22-01, Federal Civilian Executive Branch (FCEB) agencies were given until March 21, 2026 — just two days — to apply the patch or cease use of the product. That three-day remediation window is one of the shortest CISA has imposed, reflecting the severity of active exploitation against a core network security management platform.

The Vulnerability: What CVE-2026-20131 Actually Does

CVE-2026-20131 is classified as an insecure deserialization vulnerability affecting the web interface of Cisco Secure Firewall Management Center Software. In plain terms: the FMC software accepts a Java byte stream from a remote user without properly verifying whether that user is who they claim to be or whether the data they are sending is safe to process.

An attacker who knows how to craft the right HTTP request — sent to a specific path in the FMC web interface — can supply a malicious Java object in that byte stream. When the server deserializes it, the attacker's code executes. No authentication required. No credentials to steal. Root-level code execution on the target device, delivered over the internet.

copy# Generalized description of the exploit mechanism
# Attacker sends crafted HTTP POST to FMC web interface path
# Request body: malicious serialized Java byte stream
# Server deserializes input without authentication check
# Result: arbitrary Java code executes as root on the FMC device

# Cisco Secure FMC Software — all versions prior to March 4, 2026 patch
# Also affects: Cisco Security Cloud Control (SCC) Firewall Management

The vulnerability also affects Cisco Security Cloud Control (SCC) Firewall Management. For that product, TechNadu reporting confirmed that Cisco upgraded the cloud service as part of routine maintenance, and no separate user action is required for SCC customers. Importantly, Cisco has confirmed that neither Cisco Adaptive Security Appliance (ASA) nor Cisco Firepower Threat Defense (FTD) are affected — the scope is limited to the FMC software and SCC. For all FMC deployments, patching is the only reliable remediation; Cisco has confirmed no effective workarounds exist.

It is also worth noting that the same March 4 Cisco update bundle that patched CVE-2026-20131 included 48 CVEs in total, among them CVE-2026-20079 — a second vulnerability in Cisco Secure FMC carrying an identical CVSS 10.0 rating. Organizations applying Cisco's March 4 guidance need to verify that both maximum-severity FMC vulnerabilities were addressed, not only CVE-2026-20131.

How the Attack Chain Works

Amazon's researchers did not simply observe the exploit traffic from a distance. To advance their investigation, they took a more active approach: they simulated a successfully compromised system. The exploit's second embedded URL was designed to confirm successful exploitation by causing a vulnerable target to issue an HTTP PUT request and upload a specific file. Amazon performed that request deliberately, pretending to be a compromised device — which prompted Interlock to proceed to the next stage of the attack.

That technique gave Amazon visibility into the full post-exploitation toolkit. What they found exposed on a misconfigured Interlock infrastructure server was, according to the researchers, a rare and highly revealing window into a professional ransomware operation's complete playbook.

Stage 1: Exploitation

Interlock sent crafted HTTP requests to the FMC web interface path containing two embedded URLs alongside the Java code execution payload. One URL delivered configuration data to support the exploit; the other confirmed successful execution by waiting for the target to send an HTTP PUT request back. Variations of these URLs were observed across multiple different exploit attempts, suggesting ongoing, active campaigns against multiple organizations simultaneously.

Stage 2: Malicious ELF Binary Deployment

Once exploitation was confirmed, Interlock's infrastructure issued commands directing the compromised host to fetch and execute a malicious ELF binary — a Linux executable — from a remote server. That server also hosted the group's broader operational toolkit, with different paths on the same server used for both distributing tools to compromised hosts and receiving exfiltrated data.

Stage 3: Windows Environment Reconnaissance

Amazon's team recovered a PowerShell script that Interlock deploys for systematic Windows environment mapping. The scope of what it collects is extensive: operating system and hardware details, running services, installed software, storage configuration, Hyper-V virtual machine inventory, user file listings across desktop and document directories, and browser artifacts from Chrome, Edge, Firefox, Internet Explorer, and 360 Browser — including history, bookmarks, stored credentials, and extensions. It also sweeps active network connections, ARP tables, iSCSI session data, and RDP authentication events from Windows event logs.

The script stages results to a centralized network share (\\JK-DC2\Temp) using each system's fully qualified hostname to create dedicated per-host directories, then compresses everything into ZIP archives named after each hostname and removes original raw data. The structured, per-host output format is a hallmark of ransomware intrusion chains preparing for organization-wide encryption — every machine catalogued, every file path known.

Stage 4: Custom Remote Access Trojans

Interlock maintains persistence through multiple custom-built remote access trojans (RATs). Amazon identified two primary implementations:

JavaScript implant: An obfuscated JavaScript RAT that suppresses debugging output by overriding browser console methods to hide from basic detection tools. It profiles the infected host using PowerShell and Windows Management Instrumentation (WMI), collecting system identity, domain membership, username, OS version, and privilege context. Command-and-control communication runs over persistent WebSocket connections with RC4-encrypted messages, each using a distinct 16-byte random key embedded in the packet header. The implant cycles through multiple operator-controlled hostnames and IP addresses in randomized order, with exponential backoff between reconnection attempts. It supports interactive shell access, arbitrary command execution, bidirectional file transfer, and SOCKS5 proxy tunneling. A built-in self-update and self-delete capability allows operators to replace or remove the implant without reinfecting the host, supporting operational cleanup to obstruct forensic investigation.

Java implant: A functionally equivalent RAT built in Java rather than JavaScript, using GlassFish ecosystem libraries, Grizzly for non-blocking I/O transport, and Tyrus for WebSocket protocol communication. Amazon's assessment was direct: Interlock built the same backdoor in two programming languages. If defenders detect one version, the other remains operational.

Stage 5: Infrastructure Laundering

A Bash script found on the exposed server configures Linux servers as HTTP reverse proxies to obscure the true origin of attack traffic. It installs HAProxy 3.1.2 from source, configured to listen on port 80 and forward all traffic to a hardcoded target IP, with systemd ensuring it survives reboots. A cron job runs every five minutes to wipe all log files under /var/log and suppress shell history by unsetting the HISTFILE variable. Wiping logs every five minutes while running a purpose-built traffic relay represents serious operational security discipline — these are not opportunistic attackers cleaning up after themselves. This is infrastructure built specifically to defeat attribution.

Stage 6: Memory-Resident Java Webshell

Amazon also identified a Java class file delivered as an alternative to the ELF binary drop. When loaded by the Java Virtual Machine, its static initializer registers a ServletRequestListener with the server's StandardContext — installing a persistent backdoor that intercepts HTTP requests without writing any files to disk. This fileless approach evades conventional antivirus tools that scan for malicious files on disk.

The listener inspects incoming requests for specially crafted parameters containing encrypted command payloads. Those payloads are decrypted using AES-128 with a key derived from the MD5 hash of the hardcoded seed geckoformboundary99fec155ea301140cbe26faf55ed2f40 (using the first 16 characters: 09b1a8422e8faed0). Decrypted payloads are treated as compiled Java bytecode, dynamically loaded into the JVM, and executed — running entirely in memory with no trace left on disk.

Stage 7: Connectivity Verification Beacon

Amazon recovered Java class files implementing a basic TCP server listening on port 45588 (encoded as Unicode character 넔 to obscure the port number from static analysis). The server accepts connections, logs the connecting IP, sends a greeting, and immediately closes. This is a lightweight phone-home tool — used either to verify successful code execution after initial exploitation or to confirm that a specific network port is reachable before proceeding to the next stage.

Legitimate Tools Weaponized

Beyond custom malware, Interlock deployed three legitimate tools to blend their activity with authorized network traffic:

• ConnectWise ScreenConnect — a legitimate commercial remote desktop tool deployed alongside custom implants to provide a redundant access pathway. If defenders detect and remove the custom backdoors, ScreenConnect remains. Its legitimate network footprint makes it harder to distinguish from authorized remote administration.
• Volatility — an open-source memory forensics framework normally used by incident responders. No artifacts indicated automated use, but its presence in the toolkit is consistent with credential harvesting from RAM — targeting passwords, tokens, and session data that never touch disk. Both ransomware groups and nation-state actors have been documented deploying Volatility during intrusions.
• Certify — an open-source offensive security tool designed to identify and exploit misconfigurations in Active Directory Certificate Services (AD CS). For ransomware operators, Certify provides a pathway to request authentication-capable certificates that can impersonate users, escalate privileges, or maintain persistent access even after password resets. Its use here indicates Interlock was not just encrypting files — they were pursuing durable, credential-level control of victim environments.

Attribution and Operational Profile

Amazon attributed the campaign to Interlock based on convergent technical and operational indicators: the ELF binary, embedded ransom note, TOR negotiation portal, and per-victim organization tracking identifiers in the ransom note all match Interlock's established patterns. The ransom note also threatened to report victims to data protection regulators — a deliberate pressure tactic that adds the threat of regulatory fines and compliance violations on top of data encryption and public exposure.

Temporal analysis of timestamps from observed activity, artifacts on the exposed server, and metadata embedded in recovered tools indicates the operators work primarily in the UTC+3 time zone, with approximately 75–80% confidence. Peak activity runs between 12:00 and 18:00 UTC+3, with a probable sleep window between 00:30 and 08:30 — a pattern consistent with a professional operation running during standard business hours in Eastern Europe or the Middle East.

Who Is Interlock?

Interlock emerged in September 2024 and rapidly established itself as one of the more technically capable and aggressive ransomware operations in the current threat landscape. The group — tracked by IBM X-Force as Hive0163 — specializes in post-compromise activity, using multiple custom backdoors to maintain long-term access to corporate environments for large-scale data exfiltration before deploying ransomware.

Their confirmed victim list includes organizations that many ransomware groups would find difficult to breach. DaVita, the kidney dialysis firm, was compromised. Kettering Health was hit hard enough that the group not only disrupted chemotherapy sessions and pre-surgery appointments, but also leaked cancer patients' details publicly. The Texas Tech University System was targeted. The city of Saint Paul, Minnesota saw 43 GB of files stolen, forcing the state's capital to declare a state of national emergency. Interlock also struck Kalamazoo Public Schools and Wayne County.

Earlier in their operation, Interlock deployed a remote access trojan called NodeSnake against multiple UK universities. The group was among the first ransomware operations to adopt the ClickFix social engineering technique — fake CAPTCHA pages that manipulate users into running malicious PowerShell commands themselves — and later expanded to the FileFix variant of the same approach.

The AI-Generated Malware Problem

Alongside the Cisco zero-day campaign, IBM X-Force published separate findings in early March 2026 revealing that Hive0163 had deployed a new malware strain during an earlier Interlock ransomware attack. They named it Slopoly. The report was authored by IBM X-Force researcher Golo Mühr.

IBM's researchers assessed with high confidence that Slopoly was generated using a large language model. The indicators were unmistakable: extensive code commentary, structured logging, well-organized error handling, clearly named variables, and an unused "Jitter" function that likely survived from an iterative AI-assisted development process. These characteristics are common in AI-generated code and rare in human-developed malware, where obfuscation and brevity are standard practice.

"Although still relatively unspectacular, AI-generated malware such as Slopoly shows how easily threat actors can weaponize AI to develop new malware frameworks in a fraction of the time it used to take."

— Golo Mühr, IBM X-Force researcher (IBM X-Force blog, March 2026)

Slopoly was deployed during the later stages of the attack, after NodeSnake and InterlockRAT were already in place. The full intrusion chain IBM documented proceeded in sequence: initial access via a ClickFix social engineering attack, deployment of NodeSnake (a Node.js-based first-stage backdoor), escalation to InterlockRAT for richer capabilities including SOCKS5 tunneling and reverse shell, and finally deployment of the Interlock ransomware payload — delivered as a 64-bit PE file wrapped inside the JunkFiction loader, typically dropped into a temporary user directory. Slopoly appeared alongside this final stage, suggesting the group was running it as a live-fire test of their AI-generated C2 framework under real operational conditions.

Slopoly persisted via a scheduled task named "Runtime Broker" — a name chosen to blend with legitimate Windows processes — and was dropped into C:\ProgramData\Microsoft\Windows\Runtime\. It sends JSON heartbeat beacons to its C2 server every 30 seconds, checks for commands roughly every 50 seconds, executes received instructions via cmd.exe, and maintains a local log file named persistence.log that rotates at 1 MB.

Technically, Slopoly is not sophisticated. IBM X-Force explicitly noted that despite the script describing itself as a "Polymorphic C2 Persistence Client," it lacks any actual ability to modify its own code during execution. What makes it significant is not what it can do, but what it represents: a major ransomware group running AI tools to build custom malware on demand, reducing the time and cost of developing new attack components.

IBM noted that the quality of Slopoly's code suggests it was produced by a less advanced model. The implication — that more capable models would produce more capable malware — is not reassuring. Palo Alto's Unit 42, in their 2026 Global Incident Response Report published shortly after IBM's findings, identified similar patterns of AI adoption across multiple ransomware engagements.

Palo Alto's Unit 42 2026 Global Incident Response Report, published shortly after IBM's findings, independently identified similar patterns of AI adoption across multiple ransomware engagements, concluding that AI is already acting as a force multiplier — compressing attack timelines, lowering the barrier to entry, and enabling operators to scale campaigns with templated, AI-assisted scripts.

— Palo Alto Unit 42, 2026 Global Incident Response Report (independently corroborating IBM X-Force findings, March 2026)

A Pattern Cisco Cannot Ignore

CVE-2026-20131 is not an isolated incident for Cisco. Since the start of 2026 alone, the company has addressed multiple maximum-severity vulnerabilities that were exploited as zero-days before patches were available. CVE-2025-20393 (AsyncOS) was used to breach Cisco Email Security Gateway and Secure Email and Web Manager appliances starting in November 2025, months before its patch. CVE-2026-20045 affected Cisco Unified Communications products and was actively exploited before disclosure. CVE-2026-20127 (Cisco Catalyst SD-WAN Controller) allowed authentication bypass and had also been exploited before Cisco patched it. All three appeared in CISA's Known Exploited Vulnerabilities catalog alongside CVE-2026-20131. Help Net Security reported that CVE-2026-20131 represents the third Cisco vulnerability confirmed as exploited as a zero-day since the start of 2026 — a concentration across a single vendor's product line that is difficult to characterize as coincidental.

The concentration of zero-day exploitation across Cisco's product line in a single quarter reflects a broader shift that Google's threat intelligence team also identified in March 2026: ransomware actors are increasingly targeting vulnerabilities in common VPNs and firewalls for initial access, leaning less on external tooling and more on built-in Windows capabilities once inside. As Google put it in its own reporting on ransomware trends, the actors are changing their approach in response to declining ransom payment rates — and network perimeter devices are becoming the preferred entry point.

What Defenders Need to Do Right Now

Amazon's advisory and Cisco's updated security notice are unambiguous about the required response for any organization running Cisco Secure Firewall Management Center Software. The following actions are not optional:

1. Apply Cisco's patch immediately. The fix was released March 4, 2026. Any unpatched FMC instance exposed to the internet is a target. Do not wait for scheduled maintenance windows. Cisco has confirmed no effective workaround exists — patching is the only remediation. Note: ASA and FTD are not affected; this is specific to FMC and SCC.
2. Conduct a security assessment for existing compromise. The zero-day was active since January 26. Organizations that had internet-exposed FMC instances during that period should treat themselves as potentially compromised and investigate accordingly — checking for unauthorized processes, unexpected outbound connections, memory-resident activity, and signs of lateral movement.
3. Hunt for the fileless webshell using JVM instrumentation — not antivirus. Interlock deployed a memory-resident Java webshell that leaves no files on disk. Traditional antivirus and EDR tools that rely on file scanning will not find it. The correct detection approach is JVM-level instrumentation. Runtime Application Self-Protection (RASP) agents — including tools like Alibaba's open-source Arthas diagnostic toolkit and the research-grade JShellDetector — work by monitoring JVM method invocations in real time, flagging anomalous ServletRequestListener or Filter registrations that no legitimate deployment would produce. Look specifically for dynamically registered servlet components with no corresponding deployment descriptor entry. Look for classes loaded at runtime via retransformClasses that were not present at application startup. Monitor for AES-128 encrypted HTTP payloads with parameters derived from the seed geckoformboundary99fec155ea301140cbe26faf55ed2f40. A dual-layer in-memory monitoring approach — combining behavioral anomaly detection with static bytecode analysis of loaded classes — provides coverage where file-based tools have no visibility.
4. Treat AD CS as a Tier 0 attack surface, not a background infrastructure component. Interlock used Certify to exploit AD CS misconfigurations — specifically the ESC1 vulnerability class, which allows low-privileged users to request authentication-capable certificates for domain admin accounts when certificate templates have the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag enabled. Microsoft's own assessment indicates that between 30 and 40 percent of enterprise environments with AD CS deployed contain at least one high-severity exploitable misconfiguration. Run Certipy (the offensive/defensive Python toolkit) or PSPKIAudit against your environment now: certipy find -u 'user@domain' -p 'password' -dc-ip '10.x.x.x' -enabled. The output will enumerate all active ESC vulnerability classes. Pay particular attention to templates that combine authentication EKUs with enrollment rights granted to Domain Users or Authenticated Users groups. Remediation requires revoking vulnerable template permissions, enabling Manager Approval on templates that cannot be immediately locked down, and setting StrongCertificateBindingEnforcement to 2 (full enforcement) in the registry. Critically: password resets do not revoke certificates. If Interlock obtained authentication certificates before you patch, those certificates remain valid until you explicitly revoke them through the CA. Certificate revocation must be part of your incident response, not an afterthought. Enable Event ID 4886 (certificate request) and 4887 (certificate issuance) logging and correlate them — legitimate issuance shows requester and subject as the same account; ESC1 abuse produces a requester/subject mismatch that is readily detectable with a basic SIEM query.
5. Review ScreenConnect deployments for unauthorized installations. Amazon's advisory specifically flags this. Interlock installs legitimate remote access software as a backup access pathway. If a ScreenConnect instance appears on a host that was not deliberately enrolled, treat it as an active intrusion indicator. Inventory all remote management tools and compare against your authorized deployment list.
6. Do not rely on file hashes for detection — build behavioral hunt queries. Amazon's advisory explicitly warns that Interlock customized artifacts on a per-target basis. Functionally identical tools were delivered with different hashes to different victim organizations. Signature-based detection will fail. Build hunt queries around behavioral patterns: anomalous PowerShell execution staging ZIP archives to network shares named with fully qualified hostnames, WebSocket traffic on non-standard ports with exponential backoff reconnection behavior, scheduled tasks named "Runtime Broker" located outside %SystemRoot%\System32, TCP connections to port 45588 (encoded as Unicode character 넔), JSON heartbeat beacons at 30-second intervals, and log files under /var/log being truncated on a five-minute cycle. The HAProxy installation pattern — installed from source to a non-standard path, configured with a systemd unit file and a cron-based log wiper — is highly anomalous and should appear in any endpoint telemetry covering package installation activity.
7. Check network logs for known Hive0163 infrastructure. The Slopoly C2 domain plurfestivalgalaxy[.]com is now inactive, but historical connections in logs are still significant evidence of prior compromise. Known C2 IP addresses: 94.156.181[.]89, 77.42.75[.]119, 23.227.203[.]123, and 172.86.68[.]64. Block these and audit historical logs for any connections dating to January 26 or later.
8. Rethink your network segmentation model assuming the attacker already has FMC-level visibility. This is the structural lesson most organizations miss. When a firewall management platform is the entry point, the attacker does not just have access to a single device — they have a map of your entire network architecture, visibility into every firewall policy and rule, and potentially the ability to modify traffic inspection behavior to hide their lateral movement. Defense-in-depth in this context means designing your internal network so that a compromised management plane does not directly translate to a compromised data plane. Micro-segmentation between high-value asset groups, out-of-band management networks that are physically or cryptographically separate from production traffic paths, and zero-trust authentication for east-west movement are not bonus hardening steps here — they are the controls that determine whether an FMC compromise becomes a contained security incident or a full-network encryption event. Organizations running flat internal networks behind a perimeter that has now been breached have no remaining defensive layer. That is the architectural failure CVE-2026-20131 exposes.

The Harder Questions This Campaign Forces

Every major intrusion teaches something beyond the obvious patch-and-hunt checklist. CVE-2026-20131 raises several questions that the security industry has been deferring, and Interlock's campaign makes them impossible to avoid.

The Vendor Notification Gap

Cisco published its patch on March 4. Amazon confirmed exploitation began January 26. That 36-day gap is not a story about Cisco being slow — it is a story about the fundamental information asymmetry in vulnerability disclosure. Amazon only knew about the exploitation because their MadPot honeypot network captured it. Most organizations have no equivalent passive sensor infrastructure. The question this raises is not "why didn't Cisco find it sooner?" but "what is the mechanism by which defenders learn about zero-day exploitation when the vendor doesn't yet know?" The current answer — threat intelligence firms, honeypot operators, and incident responders publishing findings post-breach — is structurally reactive. It depends on an attacker doing something visible enough to be captured, and a researcher being positioned to capture it. For the 36 days before Amazon published, every organization running an internet-exposed FMC was operating on the assumption that their perimeter was intact. That assumption was wrong for an unknown number of them.

The Asset Exposure Inventory Problem

Cisco's guidance is unambiguous: do not expose FMC to the internet. Yet Interlock found enough exposed instances to run an active, multi-target campaign for over a month. This is not a failure of patching — it is a failure of asset inventory. Organizations cannot patch what they do not know is exposed, and they cannot remove internet-facing exposure they have not mapped. The remediation for this specific campaign starts with the patch. But the structural remediation starts with a continuous external attack surface management program that answers, at any given moment, which of your management interfaces are reachable from the internet. Traditional quarterly or annual network audits do not operate at the tempo this threat environment requires.

The AI-Assisted Development Trajectory

IBM X-Force's finding that Slopoly was produced by a less capable model, combined with the observation that more capable models would produce more capable malware, describes a trajectory rather than a static threat level. The defensive question is not "how do we detect Slopoly?" — it is "what does this attack chain look like when the C2 framework was written by a model two generations more capable?" The behavioral indicators that make Slopoly detectable today — 30-second heartbeat intervals, static scheduled task names, predictable log rotation — are artifacts of the model's current limitations. Improved AI-assisted malware development will produce fewer of those artifacts. The detection surface will shrink as the development tools improve. This is not a theoretical future threat; IBM has confirmed the iterative process is already underway.

The Persistence Problem That Patching Cannot Solve

Organizations that patch CVE-2026-20131 today have closed the initial entry point. They have not necessarily removed an attacker who entered through it. The Interlock toolkit is specifically designed around persistence mechanisms that survive patching: a fileless webshell that runs only in JVM memory, certificate-based authentication that survives password resets, a JavaScript RAT with self-update capability, a Java RAT as a redundant second channel, and legitimate remote access software installed under normal-looking names. An organization that patches without also hunting for these persistence artifacts has secured the front door while an attacker who entered through it weeks ago remains inside. The patch closes an entry point. Incident response, memory forensics, AD CS certificate auditing, and behavioral hunting close the intrusion.

"The real story here isn't just about one vulnerability or one ransomware group — it's about the fundamental challenge zero-day exploits pose to every security model. When attackers exploit vulnerabilities before patches exist, even the most diligent patching programs can't protect you in that critical window. This is precisely why defense in depth is essential — layered security controls provide protection when any single control fails or hasn't yet been deployed."

— CJ Moses, CISO, Amazon Integrated Security (AWS Security Blog, March 18, 2026)

Key Takeaways

1. Zero-day advantage is the new normal for sophisticated ransomware: Interlock had 36 days of unrestricted access to enterprise firewalls before Cisco even knew the vulnerability existed. Waiting for patches is not a security strategy — it is a gamble on whether your organization becomes a target before the patch arrives.
2. AI is accelerating malware development in observable, measurable ways: IBM X-Force found concrete evidence that Hive0163 used large language models to generate a working C2 framework. The code quality will improve as models improve. IBM researcher Golo Mühr and Palo Alto Unit 42 independently identified this pattern in the same reporting window, confirming it is not an isolated incident.
3. Interlock's exposed toolkit confirms they are not opportunistic: A PowerShell reconnaissance script staging per-host ZIP archives to a named network share. RATs built in two separate programming languages for redundancy. A fileless Java webshell that runs entirely in JVM memory. A traffic-laundering proxy that wipes its logs every five minutes. Certify for AD CS exploitation. Volatility for in-memory credential extraction. This is a disciplined, professional operation with a layered persistence strategy — not a smash-and-encrypt crew.
4. File hashes are not reliable IoCs for this campaign: Amazon's advisory is explicit about this. Interlock customized every artifact per-target, making signature-based detection ineffective. Organizations that are only running hash-based detection against this group are running blind. Behavioral hunting and memory forensics are required.
5. Cisco's perimeter devices are a high-priority target category right now: Multiple maximum-severity Cisco zero-days exploited in a single quarter is a pattern, not a coincidence. Organizations relying on Cisco FMC, AsyncOS, Unified Communications, or SD-WAN products should treat those systems as elevated-risk entry points and prioritize monitoring and patching accordingly.
6. Network perimeter compromise requires a different incident response posture: When a firewall management platform is the entry point, the attacker has visibility into — and potential control over — the entire network architecture. Organizations should assume that any compromise of FMC means the attacker understands their network topology, has likely already used Certify to establish certificate-based persistence, and has already planned lateral movement to every segment.

The Interlock campaign against CVE-2026-20131 is a case study in what modern ransomware groups can accomplish when they obtain a zero-day against a high-value network infrastructure target. Amazon's willingness to publish detailed technical findings — including the full attack chain, every toolkit component down to the AES key seed in the memory-resident webshell, and actionable indicators of compromise — provides defenders with an unusually complete picture of how the intrusion works. Use it.