Interlock Exploits Cisco Firewall Zero-Day Since January

A ransomware group known as Interlock has been exploiting a critical vulnerability in Cisco's Secure Firewall Management Center software since late January, more than a month before the company publicly disclosed the flaw, according to researchers at Amazon Integrated Security.

The vulnerability, identified as CVE-2026-20131, affects the web-based management interface of the Cisco product and carries a maximum severity score of 10 on the CVSS scale. It allows an unauthenticated remote attacker to execute arbitrary Java code with root privileges on affected devices. Amazon's threat intelligence team determined that Interlock began using the flaw in attacks on January 26, 2026, operating with a zero-day advantage that gave the group a significant head start over defenders. Cisco patched the vulnerability on March 4, 2026, and updated its advisory this week to confirm active exploitation in the wild. Attacks remain ongoing, the company stated.

Researchers uncovered the campaign through Amazon's global honeypot network, known as MadPot, which observed malicious activity, and a misconfigured infrastructure server used by Interlock as a staging area. This server exposed the group's...