Interlock Ransomware Exploited Cisco Zero-Day for Weeks Before Patch

Interlock ransomware exploited a Cisco firewall flaw before its patch, underscoring zero-day threats. Upgrade to patched versions now.

By Content Team

Mar 21, 2026

ON THIS PAGE

The Interlock ransomware gang exploited a critical Cisco firewall vulnerability (CVE-2026-20131) as early as January 26, weeks before Cisco disclosed and patched it on March 4. Amazon Web Services researchers discovered this through honeypots and a misconfigured Interlock server that exposed their complete attack toolkit.

The vulnerability affects Cisco's Secure Firewall Management Center software, allowing remote attackers to execute code as root. Interlock used sophisticated tools including PowerShell scripts, remote-access Trojans, and memory-resident backdoors to maintain persistent access to compromised networks.

This case highlights the danger of zero-day exploits, where even well-maintained systems remain vulnerable until patches become available. Cisco users should immediately upgrade to fixed releases.

Source: Dark Reading

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?