Three threat groups linked to ransomware and state-sponsored cyber attacks have exploited two vulnerabilities in Cisco Secure Firewall Management Center (FMC) appliances, according to Cisco’s Talos intelligence team.
The intrusions allowed attackers to deploy web shells, steal credentials, create covert routes into internal networks and install malware including Qilin ransomware and Cyclops Blink.
Cisco is tracking the activity under the identifiers UAT-11988, UAT-11823 and UAT-12197. The company has released hotfixes for both flaws and is urging customers to apply them immediately.
The most serious vulnerability, CVE-2026-20079, carries a maximum CVSS severity score of 10.0. It enables an unauthenticated remote attacker to bypass login protections and run scripts as root on an affected FMC device.
The second flaw, CVE-2026-20316, has a score of 5.3 and allows access using static credentials assigned to a low-privileged account. Cisco has classified it as high severity because it can be combined with other weaknesses to gain greater control.
Qilin ransomware attack
Talos said it had attributed the UAT-11988 activity with high confidence to affiliates of the Qilin ransomware operation.
The attackers used the static credentials associated with CVE-2026-20316 to enter an FMC appliance before using legitimate tools on the device to map the victim’s network.
The information gathered included hostnames, IP addresses, directory listings, Active Directory service account credentials, MySQL credentials and details of domain-connected computers. The attackers also collected information linking internal hostnames to their IP addresses.
Data was placed in files that could be accessed publicly from the compromised FMC server and then retrieved through HTTP requests, Talos said.
The group created a Python SOCKS5 proxy and a reverse SSH tunnel, enabling it to maintain access and route traffic to services including LDAP, Kerberos, SMB, NetBIOS and Windows Remote Management.
After the reconnaissance phase, the attackers used tools including Impacket and Invoke-TheHash, as well as software designed to disable endpoint detection and response protections. Qilin ransomware was then deployed to encrypt files on victim systems.
Sandworm-linked malware deployed
A separate campaign, tracked as UAT-11823, was attributed with high confidence to an advanced persistent threat group whose tools overlap with those associated with Sandworm.
Sandworm has been linked to Russia’s military intelligence service, the GRU, and has previously been associated with destructive attacks against government and critical infrastructure targets.
In this case, the attackers gained access either by exploiting the authentication bypass in CVE-2026-20079 or by using the static credentials linked to CVE-2026-20316. Talos believes the group used both vulnerabilities during the wider campaign.
The attackers altered a file called license.tmp to establish a Netcat reverse shell to their command-and-control infrastructure. Cisco’s legitimate package_info.pl utility was then used to execute the malicious file with root privileges.
Scripts were also used to collect configuration information from devices managed through the FMC system and save it in archives for later removal.
The campaign ultimately delivered a version of Cyclops Blink, a modular Linux malware family previously attributed to Sandworm. The malware can provide persistent access, steal credentials and monitor network traffic.
Web shell used to steal credentials
The third cluster, UAT-12197, exploited CVE-2026-20079 and installed a JavaServer Pages web shell in the Tomcat web directory used by Cisco Security Manager.
The shell was used to place a malicious Java archive, named cmd.jar, on the server. This gave the attackers a way to run commands, query internal databases and obtain authentication information and other credentials.
Talos said the findings also confirmed that the two vulnerabilities were connected to attacks disclosed by Cisco in July. At the time, the company said CVE-2026-20316 was being actively exploited and warned that it could be combined with other flaws to increase an attacker’s privileges.
Cisco also added the same /var/tmp/license.tmp file to its advisory for CVE-2026-20079, but did not initially confirm whether the authentication bypass was being exploited or explain how the two issues were related.
Talos has now said that the Sandworm-linked activity exploited both vulnerabilities and used the malicious license.tmp method.
Cisco said it will issue a broader hardening update covering additional vulnerabilities. Customers are being advised to install the available hotfixes without delay and review their FMC systems for signs of unauthorised access.
