Russian military hackers and the Qilin ransomware collective have simultaneously compromised Cisco Secure Firewall Management Center, using authentication bypass and hardcoded credentials to seize control of entire enterprise firewall fleets and exfiltrate sensitive data.
Compromising a single Cisco Secure Firewall Management Center (FMC) can give attackers control over an entire organization's perimeter. In a recent coordinated attack, both Sandworm-the Russian GRU unit behind NotPetya-and the Qilin ransomware group broke into the central console that manages firewall policies, device credentials, and network maps for major organizations. With root access, the attackers gained full visibility and could use the security infrastructure itself for espionage and extortion.
This breach stands out not just because of who was involved, but because of what was targeted. Cisco FMC is the central management point for firewalls in medium and large enterprises, service providers, and government agencies. A single exploit can hand over control of all network defenses, configurations, and credentials. Cisco Talos has confirmed three separate attacker groups exploiting two critical vulnerabilities in on-premises FMC software. The first signs of exploitation date back to July 2026, with public disclosure coming weeks after attackers were already inside.
Le vulnerabilità che hanno aperto la porta
The attackers used two flaws: CVE-2026-20079, a critical authentication bypass (CVSS 10.0), and CVE-2026-20316, a hardcoded credential backdoor (CVSS 5.3, but rated High Impact by Cisco). The first lets unauthenticated attackers send a crafted HTTP request to the FMC web interface, bypassing login controls and running scripts as root. The second exposes static login details for a low-privilege account, which can be combined with the first flaw or a legitimate utility to take over the system. Patches were released in March 2026, but attackers had already started exploiting the flaws by late July-before most organizations were aware.
CVE-2026-20079 is a critical authentication bypass vulnerability (CVSS 10.0) that allows a remote, unauthenticated attacker to execute scripts on the device and obtain root access.
Sandworm e Cyclops Blink: la spia nella console
Sandworm's involvement signals a shift in tactics. Talos links one attacker cluster (UAT-11823) to the Russian GRU, citing tool overlap and familiar methods: after gaining access through both vulnerabilities, the attackers swapped the legitimate license file for a self-extracting archive containing a Netcat-based reverse shell, run as root using Cisco's package_info.pl utility. This approach, which relies on trusted admin tools to run attacker code, often slips past endpoint detection.
Sandworm went further than remote access. The group used bash scripts to collect the full configuration of every managed firewall, staged the data for exfiltration, and installed Cyclops Blink-a modular implant previously seen in attacks on WatchGuard and ASUS routers. The 2026 version, identified by its signature hash, provides persistent access, encrypted command-and-control via DNS-over-HTTPS, credential theft, network scanning, and packet sniffing. Once on the FMC, Cyclops Blink acts as a surveillance node with visibility into all firewall traffic.
Qilin ransomware: la gestione della sicurezza come piattaforma di attacco
While Sandworm focused on espionage, Qilin's affiliate (UAT-11988) used the management plane for ransomware. Using the hardcoded credentials from CVE-2026-20316, the attackers escalated privileges with the same package_info.pl method, then mapped out the environment: hostnames, IPs, directory structures, Active Directory and MySQL credentials, domain account lists, and critical server mappings. All data was staged and exfiltrated using the FMC's outbound web connectivity to avoid detection.
After mapping the network, Qilin set up persistent access with a Python SOCKS5 proxy and reverse-SSH tunnel, forwarding ports into the victim's Active Directory environment. Only then did the ransomware phase begin: Impacket and Invoke-TheHash for credential relay, custom payloads to disable endpoint security, and finally Qilin ransomware deployed against selected high-value systems. The result was targeted encryption of the most critical assets-an approach that has already hit organizations like Covenant Health and the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives in 2026.
La convergenza degli attaccanti e le prove concrete
Three attacker groups-Sandworm, Qilin, and a third focused on credential theft-all targeted the FMC for the same reason: compromise it, and you control the entire firewall fleet. Both Sandworm and Qilin used Cisco's package_info.pl utility to run their payloads as root, taking advantage of defenders' trust in legitimate admin tools. The credential theft cluster (UAT-12197) used a JSP web shell and a malicious Java Archive to extract all user authentication data from the FMC's internal database, turning the console into a source of credentials for further attacks.
These are not hypothetical risks. Talos has published Snort rules, file hashes for the web shell, cmd.jar, and Cyclops Blink, and five confirmed attacker IPs. Administrators are advised to check for unexpected files in Tomcat webroots, logs referencing /var/tmp/license.tmp, unusual outbound connections, and any use of package_info.pl with non-standard arguments. A single log entry referencing the tampered license file should be treated as evidence of full compromise.
Impatto e risposta: cosa devono fare le organizzazioni
The patch deadline for federal agencies is only a starting point. Cisco has released hotfixes for affected FMC versions (7.0, 7.2, 7.4, 7.6, 7.7, and 10.0), but there is no workaround for CVE-2026-20079-restricting management interface access lowers risk but does not remove it. Organizations unable to patch immediately should treat any sign of compromise as a total loss of trust in the FMC and contact Cisco TAC for support.
This breach is not an isolated case. As reported earlier in the context of Magento zero-days, attackers are increasingly targeting management planes and admin consoles, where a single foothold gives them broad control. The Cisco FMC campaign shows why patching delays and misplaced trust in "secure" appliances are no longer acceptable in today's threat landscape.
Sandworm's move from small-office routers to enterprise security management consoles marks a new level of ambition. Qilin's methodical use of the same infrastructure for ransomware shows that criminal and state-backed actors are learning from each other. The lesson is clear: the management plane is now the front line, and treating it as just another server is a serious risk. Attackers no longer need to breach dozens of endpoints-one unpatched console can bring down the whole network.
