Cisco FMC Under Attack: Three Threat Groups Deploy Web Shells, Cyclops Blink, and Qilin Ransomware
Cisco FMC Under Attack: Three Threat Groups Deploy Web Shells, Cyclops Blink, and Qilin Ransomware
Cisco Talos is tracking three separate threat groups exploiting recently patched vulnerabilities in the Secure Firewall Management Center (FMC), the central console that manages Cisco firewall deployments. The campaigns — attributed to crimeware and state-sponsored actors — steal credentials, plant web shells, gain root access, and in one cluster end with Qilin ransomware deployed across victim networks.
The Flaws
The primary target is CVE-2026-20079, a critical authentication bypass that allows unauthenticated attackers to remotely bypass security controls, run scripts, and potentially gain root access on FMC appliances. Attackers are also chaining CVE-2026-20316, which allows access to sensitive data through a low-privilege account and can be combined with other FMC vulnerabilities for privilege escalation. CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities catalog with a September 12, 2026 federal patch deadline; CVE-2026-20316 was added in late July.
Three Clusters of Activity
The first cluster, tracked as UAT-12197, exploits CVE-2026-20079 and places JSP-based web shells in the CSM Tomcat webroot directory, alongside a Java Archive-based command executor used to query internal databases and harvest user authentication data and credentials. The second, UAT-11823, is an advanced persistent threat actor with tooling that overlaps Sandworm. It establishes Netcat reverse shells by replacing the "license.tmp" file on disk, harvests device configurations, and installs the modular ELF malware Cyclops Blink for persistent access, DNS over HTTPS resolution, and packet sniffing. The third cluster, UAT-11988, belongs to Qilin ransomware operators: using static credentials for initial access, they perform extensive domain reconnaissance, deploy a Python SOCKS5 proxy and reverse-SSH tunnels forwarding LDAP, LDAPS, Kerberos, SMB, NetBIOS, and WinRM ports, and run open-source tooling such as impacket and Invoke-TheHash alongside custom AV killers before deploying Qilin ransomware on selected endpoints.
What Should You Do?
- Apply Cisco's hotfixes now. Both CVEs have released fixes, and Cisco strongly urges customers to apply them immediately and update detection rules using the provided Snort SIDs while comprehensive hardening updates are finalized.
- Rotate every static credential on the FMC. Two of the three clusters relied on static credentials rather than the exploit — credential hygiene is the patch for that path.
- Hunt for web shells and tunnels. Inspect Tomcat webroot directories for unexpected JSP files, and watch for reverse-SSH tunnels and SOCKS proxy processes on management appliances.
- Get the management plane off the internet. An FMC reachable from outside is an open invitation to exactly these chains.
The WAF Angle
There is a bitter irony here: the management console for firewalls — the security infrastructure itself — is a web application, and the attack pattern is a classic one: auth bypass, web shell in a Tomcat webroot, credential harvesting. The lesson generalizes far beyond Cisco. Any security appliance's management interface is web attack surface, and it deserves the same treatment you would give an internet-facing app: a WAF or reverse proxy in front, strict authentication, rate limiting, and request anomaly detection that flags administrative calls no human or legitimate process should make. When attackers compromise the console that manages your perimeter, no downstream rule the console pushes can be trusted anymore.
