Ransomware gang exploits Cisco flaw in zero-day attacks since January The Interlock ransomware gang exploited a maximum-severity remote code execution vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center as a zero-day beginning January 26, 2026, enabling unauthenticated remote Java code execution as root on unpatched devices. Cisco patched the flaw on March 4 after Amazon threat intelligence found Interlock had been exploiting the vulnerability for 36 days, and Interlock — linked to ClickFix — has also deployed NodeSnake and a new AI-era strain called Slopoly while claiming attacks on DaVita, Kettering Health, the Texas Tech University System, and the city of Saint Paul. #Interlock #CiscoSecureFMC

The Interlock ransomware gang exploited a zero-day Cisco Secure Firewall flaw (CVE-2026-20131) from Jan 26 to Mar 4, enabling root remote code execution. Targets include DaVita and Texas Tech University. #RansomwareAttack #CiscoFlaw #USA

ViciousTrap Uses Cisco Flaw to Build Global Honeypot from 5300 Compromised Devices botnet known as PolarEdge read more about ViciousTrap Uses Cisco Flaw to Build Global Honeypot from 5300 Compromised Devices

ViciousTrap Uses Cisco Flaw to Build Global Honeypot from 5300 Compromised Devices reconbee.com/vicioustrap-...

#vicioustrap #ciscoflaw #globalhoneypot #cyberattack #cisco