VulnHub

The Interlock ransomware group has been exploiting a severe zero-day vulnerability in Cisco Secure Firewall Management Center software, identified as CVE-2026-20131, since January 26, prior to its public disclosure. This vulnerability allows for insecure deserialization, which can lead to unauthorized access and potential takeover of affected systems. Organizations using Cisco's Secure Firewall Management Center should be particularly vigilant, as the attacks have been ongoing for over a month, posing a significant risk to network security. The situation emphasizes the urgent need for timely security updates and monitoring to protect against such exploitation.

Researchers have uncovered a toolkit used by the Beast Ransomware group, detailing their methods from initial reconnaissance to the final encryption of files. This toolkit includes various tools that allow the attackers to gather intelligence on their targets, exploit vulnerabilities, and encrypt victims' data for ransom. The discovery is significant because it provides insight into the operational techniques of the group, potentially helping organizations bolster their defenses against future attacks. Companies in sectors that typically face ransomware threats should pay close attention to these findings and review their security measures accordingly. The information also serves as a reminder of the ongoing risks posed by ransomware actors, who continue to evolve their tactics.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has alerted government agencies about two significant security vulnerabilities affecting the Synacor Zimbra Collaboration Suite (ZCS) and Microsoft Office SharePoint. Both flaws, identified as CVE-2025-66376 and another not specified in the article, have been found to be actively exploited by attackers. The CVE-2025-66376 vulnerability has a CVSS score of 7.2, indicating a moderate to high risk. Organizations using these platforms are urged to apply the necessary patches to protect against potential attacks. The exploitation of these vulnerabilities underscores the need for timely updates and vigilance in cybersecurity practices, especially for government entities.

The University of Mississippi Medical Center and Passaic County in New Jersey have recently fallen victim to attacks from a ransomware group known as Medusa, which is believed to operate from Russia. This ransomware-as-a-service operation has claimed responsibility for the incidents, raising concerns about the security of healthcare and local government systems. The attacks can disrupt critical services and compromise sensitive data, which is particularly alarming in the healthcare sector where patient information is at stake. As ransomware attacks become increasingly common, organizations must prioritize their cybersecurity measures to protect against such threats and ensure they can continue to serve their communities effectively.

The Interlock ransomware gang has been actively exploiting a serious remote code execution vulnerability in Cisco's Secure Firewall Management Center (FMC) software since late January. This flaw, classified as having maximum severity, allows attackers to execute arbitrary code on affected systems, putting organizations at significant risk. Companies using this software should be particularly vigilant, as the vulnerability is being exploited in ongoing attacks. Cisco has not yet released a patch to address this issue, which raises concerns about the potential for widespread impact. Organizations relying on Cisco FMC should prioritize security measures and closely monitor any unusual activity to safeguard their networks.

Amazon Threat Intelligence has issued a warning regarding an active ransomware campaign known as Interlock, which is exploiting a significant vulnerability in Cisco's Secure Firewall Management Center (FMC) Software. This vulnerability, identified as CVE-2026-20131, has a maximum severity score of 10.0 and stems from an insecure deserialization of user-supplied Java byte streams. This flaw could allow attackers to gain root access without authentication, posing a serious risk to organizations using affected Cisco products. The exploitation of this vulnerability is concerning as it enables unauthorized access, potentially leading to data breaches and system compromises. Companies using Cisco FMC Software must take immediate action to protect their systems from this ongoing threat.

Marquis, a financial services provider based in Texas, recently reported that a ransomware attack in August 2025 compromised the personal data of over 672,000 individuals. The breach also had significant operational impacts, affecting 74 banks across the United States. The stolen data may include sensitive information, raising concerns about identity theft and privacy for those affected. This incident highlights the vulnerabilities in the financial sector and the ongoing threat posed by ransomware groups. Organizations in this space need to enhance their cybersecurity measures to protect both their operations and customer data.

The Warlock Ransomware Group has recently enhanced its operations by using a new technique called BYOVD, which allows them to conduct stealthier activities across networks. This technique, combined with other tools, enables the group to exploit systems more effectively and avoid detection. The implications of this development are significant, as it suggests that organizations may be at greater risk of ransomware attacks that can spread quickly across their networks. Companies should be vigilant and ensure their security measures are robust enough to counter these evolving tactics. Users need to stay informed about such threats to protect their data and systems.

A new strain of malware called Slopoly has been linked to an Interlock ransomware attack, allowing attackers to infiltrate a compromised server and remain undetected for over a week. This malware is believed to be generated using AI tools, showcasing the evolving capabilities of cybercriminals. During this time, sensitive data was stolen, raising concerns for organizations that may be targeted. The incident highlights the need for enhanced security measures to detect and respond to such sophisticated attacks. Companies must remain vigilant and update their defenses to protect against similar threats in the future.

Angelo Martino, a former negotiator for DigitalMint, is accused of running ransomware attacks while simultaneously negotiating on behalf of his employer. The U.S. government claims he extorted around $75 million through these actions, effectively playing both sides of the fence. This case raises serious concerns about insider threats within organizations that deal with cryptocurrency, as it highlights the potential for employees to exploit their positions for personal gain. The implications are significant, as it calls into question the security measures companies have in place to protect against such dual-role employees. The incident also emphasizes the ongoing challenges in combating ransomware, particularly when insiders are involved.