{
 "Event": {
  "uuid": "8da29e79-0082-5823-b874-886f01521c8d",
  "info": "Three threat clusters exploit Cisco Secure FMC flaws to steal credentials and deploy Qilin ransomware",
  "date": "2026-08-15",
  "threat_level_id": "1",
  "analysis": "2",
  "distribution": "3",
  "published": false,
  "Orgc": {
   "name": "SecurityStudies.info"
  },
  "Tag": [
   {
    "name": "tlp:clear"
   },
   {
    "name": "securitystudies:status=\"curated\""
   },
   {
    "name": "securitystudies:type=\"ransomware\""
   },
   {
    "name": "misp-galaxy:country=\"united states\""
   },
   {
    "name": "misp-galaxy:country=\"united kingdom\""
   },
   {
    "name": "misp-galaxy:country=\"germany\""
   },
   {
    "name": "misp-galaxy:country=\"australia\""
   },
   {
    "name": "misp-galaxy:sector=\"Technology\""
   },
   {
    "name": "misp-galaxy:sector=\"Critical Infrastructure\""
   },
   {
    "name": "misp-galaxy:sector=\"Government\""
   },
   {
    "name": "misp-galaxy:sector=\"Financial Services\""
   }
  ],
  "Attribute": [
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://securitystudies.info/cyber/incidents/three-threat-clusters-exploit-cisco-secure-fmc-flaws-to-steal-credentials-and-deploy-qilin-ransomware/",
    "comment": "SecurityStudies.info entry",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://thehackernews.com/2026/09/cisco-fmc-flaws-exploited-to-steal.html",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://securityaffairs.com/198884/cyber-crime/attackers-exploit-critical-cisco-fmc-flaw-to-deploy-qilin-ransomware.html",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://www.cisa.gov/news-events/alerts/2026/09/09/cisa-adds-three-known-exploited-vulnerabilities-catalog",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "text",
    "category": "Other",
    "value": "Cisco Talos identified three distinct clusters exploiting CVE-2026-20079, a CVSS 10.0 authentication bypass in Cisco Secure Firewall Management Center, alongside the lower-severity CVE-2026-20316. UAT-12197 deployed JSP web shells and Java command executors to harvest credentials and authentication data from internal databases; UAT-11823 delivered reverse shells and configuration harvesting scripts and deployed Cyclops Blink, previously attributed to Russian state-sponsored Sandworm; UAT-11988 used legitimate FMC tooling for reconnaissance and credential collection before deploying Qilin ransomware. CISA added CVE-2026-20079 to the KEV catalog on 9 September 2026 with a 12 September federal deadline.",
    "comment": "summary",
    "to_ids": false
   }
  ]
 }
}