Malware

Qilin ransomware

3 mentions in 7 days · 3 in 30 days · 3 total · first seen Sep 10, 2026 · last 4d ago

Timeline3 articles

Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware

Three threat groups, including Qilin ransomware operators, exploit critical Cisco FMC flaws CVE-2026-20079 and CVE-2026-20316 for root access, credential theft, and ransomware.

Cisco Talos identified three post-compromise clusters exploiting recently patched Cisco Secure Firewall Management Center flaws. UAT-12197 deploys JSP web shells and harvests credentials; UAT-11823 (with Sandworm-overlapping tooling) installs Cyclops Blink for persistence; UAT-11988 (Qilin) uses static credentials, extensive reconnaissance, SOCKS5 proxies, reverse-SSH tunnels, AV killers, and ransomware deployment. CISA added CVE-2026-20079 to the KEV catalog with a September 12, 2026 patch deadline for federal agencies; Cisco urges immediate hotfix application.

Security Affairsupdated Sep 14, 09:27 UTC · 1d agofirst Sep 11, 10:14 UTC · 4d agoExploit / PoC in the wild 13 sources CVE-2026-20079 CVE-2026-203165· 2 reads

Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware

Three threat clusters including a Sandworm-linked group and Qilin ransomware operators exploit Cisco FMC flaws CVE-2026-20079 and CVE-2026-20316.

Cisco Talos identified three clusters of post-compromise activity exploiting CVE-2026-20079 (CVSS 10.0, unauthenticated web-interface authentication bypass enabling root code execution) and CVE-2026-20316 (CVSS 5.3, low-privilege login exposing sensitive data) in Secure Firewall Management Center. UAT-12197 deployed JSP web shells and a JAR-based command executor to query internal databases for credentials; UAT-11823 used a Netcat reverse shell, configuration-harvesting scripts and a Cyclops Blink variant previously attributed to Russia's Sandworm; UAT-11988 used living-off-the-land FMC tooling for reconnaissance before deploying Qilin ransomware. CISA added CVE-2026-20079 to its KEV catalog, requiring FCEB agencies to patch by September 12, 2026; CVE-2026-20316 was added in late July 2026.

The Hacker Newsupdated Sep 14, 09:27 UTC · 1d agofirst Sep 11, 06:19 UTC · 4d agoExploit / PoC in the wild 13 sources CVE-2026-20079 CVE-2026-20316

Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers

Cisco Talos confirms ransomware and state-sponsored groups exploited CVE-2026-20079 and CVE-2026-20316 in Secure Firewall Management Center, deploying Qilin ransomware and Cyclops Blink.

Cisco Talos identified three threat clusters (UAT-12197, UAT-11823, UAT-11988) exploiting CVE-2026-20079, a CVSS 10.0 authentication bypass, and CVE-2026-20316, a CVSS 5.3 static-credential flaw, in Cisco Secure Firewall Management Center. Qilin affiliates used static credentials for reconnaissance and deployed Qilin ransomware; a Sandworm-linked cluster deployed a Cyclops Blink backdoor via a malicious license.tmp file; a third cluster stole credentials through a JSP web shell. Cisco has released hotfixes and urges immediate installation, with broader patches expected next week.

BleepingComputerupdated Sep 14, 09:27 UTC · 1d agofirst Sep 10, 15:43 UTC · 5d agoExploit / PoC in the wild 13 sources CVE-2026-20079 CVE-2026-20316

Related CVEsby mentions

CVE-2026-2007910.076%
Authentication bypass to root access in Cisco Secure Firewall Management Center
CVE-2026-20079 is an authentication bypass (CWE-288) in the web interface of Cisco Secure Firewall Management Center (FMC) Software, caused by an improper system process created at boot time. An unauthenticated, remote attacker can exploit it by sending crafted HTTP requests to the FMC web interface, which allows the execution of script files and commands on the device. A successful exploit grants the attacker root access to the underlying operating system, giving full control of the management platform (CVSS 3.1: 10.0, network-exploitable, no privileges or user interaction required, scope changed). The flaw affects Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management deployments. Cisco has confirmed the vulnerability is being exploited in active attacks, it carries a 35.9% EPSS score (98th percentile), and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-09.
· Cisco Secure Firewall Management Center (FMC) Software (web interface) · Cisco Security Cloud Control (SCC) Firewall Management KEV PoC ×2large
CVE-2026-203165.311%
Hard-Coded Password Vulnerability in Cisco Secure Firewall Management Center
Cisco Secure Firewall Management Center (FMC), formerly Firepower Management Center, contains a use of hard-coded password vulnerability (CWE-259) that allows an unauthenticated, remote attacker to log in to an affected system. By authenticating with the built-in hard-coded credentials for a low-privileged account, the attacker can gain access to sensitive data within the impacted systems. Any organization running an affected Cisco FMC deployment is exposed, particularly where the management interface is reachable from untrusted networks. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-29, indicating active exploitation in the wild, and related reporting describes active exploitation of FMC vulnerabilities. No CVSS score or public proof-of-concept is yet available, but EPSS assigns a 9.8% probability of exploitation within 30 days (95th percentile).
· Cisco Secure Firewall Management Center (FMC) KEV ransomwarelarge

Appears with

vendor Cisco 3 threat actor Sandworm 3 threat actor UAT-11823 3 threat actor UAT-11988 3 threat actor UAT-12197 3 malware Cyclops Blink 3 organization Cisco Talos 3 product Cisco Secure Firewall Management Center 2 product Cyclops Blink 2 threat actor Qilin 2 organization CISA 2 vendor CISA 1 product Qilin ransomware 1 organization Cisco 1 product Secure Firewall Management Center 1 product Windows 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.