CTI · reviewed · 2026-09-11

Active exploitation of Cisco Secure Firewall Management Center vulnerabilities

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1100 Web Shell Persistence
• T1059 Command and Scripting Interpreter Execution
• T1003 OS Credential Dumping Credential Access
• T1021 Remote Services Lateral Movement

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• 9.20.4.14 ipv4 · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Cisco FMC Credential Theft and Lateral Movement via Exploited CVE-2026-20079
id: f4e8a2b7-c3d1-4f5e-9a0b-6c8d2e4f1a3b
status: experimental
description: Detects post-exploitation activity on Cisco FMC instances including credential dumping via OmniQuery.pl, MySQL credential theft, and Cyclops Blink deployment patterns
references:
  - https://blog.talosintelligence.com/
  - https://www.bleepingcomputer.com/
author: Tia N. List
date: 2026-09-11
tags:
  - attack.initial-access
  - attack.t1190
  - attack.credential-access
  - attack.t1003
  - attack.lateral-movement
  - attack.t1021
logsource:
  product: windows
  category: process_creation
detection:
  selection_omniqueery:
    Image|endswith:
      - '\perl.exe'
      - '\perl5.exe'
    CommandLine|contains:
      - 'OmniQuery'
      - 'config-database'
  selection_mimikatz_like:
    Image|endswith:
      - '\rundll32.exe'
    CommandLine|contains:
      - 'CRYPTDLL'
      - 'kllist'
  selection_impacket:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
    CommandLine|contains:
      - 'impacket'
      - 'psexec'
      - 'wmiexec'
      - 'smbexec'
  selection_invokethehash:
    Image|endswith:
      - '\powershell.exe'
    CommandLine|contains:
      - 'Invoke-TheHash'
      - 'Invoke-WMIExec'
      - 'Invoke-SMBExec'
  condition: selection_omniqueery or selection_mimikatz_like or selection_impacket or selection_invokethehash
falsepositives:
  - Legitimate Cisco FMC administration tools
level: critical

References

• https://blog.talosintelligence.com/
• https://www.bleepingcomputer.com/