talos · Crawled Sep 10, 2026
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
10 IoCs 1 Malware
Read original article ↗
AI Summary
Cisco Talos is tracking active exploitation of two vulnerabilities in Cisco Secure Firewall Management Center (FMC) Software: CVE-2026-20079, a critical authentication bypass flaw, and CVE-2026-20316, which allows login via a low-privileged account. Three distinct threat clusters have been identified: UAT-12197 deployed a JSP web shell and a JAR-based command executor; UAT-11823, linked to Sandworm, used CVE-2026-20079 and CVE-2026-20316 to deploy Cyclops Blink malware via a Netcat reverse shell; and UAT-11988, a Qilin ransomware operator, leveraged static credentials to conduct reconnaissance, deploy tunneling tools, and execute ransomware. Customers are urged to apply available patches immediately.
AI-extracted · verify before operational use
Extracted Entities 1 found
Indicators of Compromise 10 extracted
| Type | Value | Detail |
|---|---|---|
| SHA-256 | b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d | Details → |
| Filename | home.jsp | Details → |
| SHA-256 | db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e | Details → |
| Filename | cmd.jar | Details → |
| IP | 89[.]34[.]96[.]56 | Details → |
| IP | 208[.]123[.]119[.]215 | Details → |
| IP | 104[.]218[.]165[.]253 | Details → |
| IP | 91[.]214[.]78[.]118 | Details → |
| SHA-256 | 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461 | Details → |
| IP | 43[.]204[.]2[.]142 | Details → |
MITRE ATT&CK TTPs 76 techniques
T1003 OS Credential Dumping · Credential Access T1012 Query Registry · Discovery T1016 System Network Configuration Discovery · Discovery T1018 Remote System Discovery · Discovery T1021 Remote Services · Lateral Movement T1021.001 Remote Desktop Protocol · Lateral Movement T1021.002 SMB/Windows Admin Shares · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1033 System Owner/User Discovery · Discovery T1040 Network Sniffing · Credential Access T1046 Network Service Discovery · Discovery T1047 Windows Management Instrumentation · Execution T1048 Exfiltration Over Alternative Protocol · Exfiltration T1053 Scheduled Task/Job · Execution T1055 Process Injection · Defense Evasion T1057 Process Discovery · Discovery T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1070.001 Clear Windows Event Logs · Defense Evasion T1070.004 File Deletion · Defense Evasion T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1078.004 Cloud Accounts · Defense Evasion T1081 T1081 T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1086 T1086 T1087 Account Discovery · Discovery T1087.002 Domain Account · Discovery T1090 Proxy · Command And Control T1095 Non-Application Layer Protocol · Command And Control T1098 Account Manipulation · Persistence T1105 Ingress Tool Transfer · Command And Control T1110 Brute Force · Credential Access T1110.003 Password Spraying · Credential Access T1112 Modify Registry · Defense Evasion T1120 Peripheral Device Discovery · Discovery T1129 Shared Modules · Execution T1133 External Remote Services · Persistence T1190 Exploit Public-Facing Application · Initial Access T1203 Exploitation for Client Execution · Execution T1210 Exploitation of Remote Services · Lateral Movement T1211 Exploitation for Defense Evasion · Defense Evasion T1212 Exploitation for Credential Access · Credential Access T1218 System Binary Proxy Execution · Defense Evasion T1222 File and Directory Permissions Modification · Defense Evasion T1222.001 Windows File and Directory Permissions Modification · Defense Evasion T1482 Domain Trust Discovery · Discovery T1484.001 Group Policy Modification · Defense Evasion T1485 Data Destruction · Impact T1486 Data Encrypted for Impact · Impact T1489 Service Stop · Impact T1490 Inhibit System Recovery · Impact T1495 Firmware Corruption · Impact T1534 Internal Spearphishing · Lateral Movement T1537 Transfer Data to Cloud Account · Exfiltration T1542.001 System Firmware · Persistence T1543.003 Windows Service · Persistence T1547.001 Registry Run Keys / Startup Folder · Persistence T1548.002 Bypass User Account Control · Privilege Escalation T1552.001 Credentials In Files · Credential Access T1558 Steal or Forge Kerberos Tickets · Credential Access T1562.001 Disable or Modify Tools · Defense Evasion T1566 Phishing · Initial Access T1566.002 Spearphishing Link · Initial Access T1569 System Services · Execution T1570 Lateral Tool Transfer · Lateral Movement T1573 Encrypted Channel · Command And Control T1574.002 DLL Side-Loading · Persistence T1588 Obtain Capabilities · Resource Development T1588.001 Malware · Resource Development T1589 Gather Victim Identity Information · Reconnaissance T1595 Active Scanning · Reconnaissance T1599 Network Boundary Bridging · Defense Evasion T1650 Acquire Access · Resource Development