CTI · reported · 2026-09-11

Cisco FMC Exploits Fuel Ransomware, APT Attacks

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1100 Web Shell Persistence
• T1059 Command and Scripting Interpreter Execution
• T1003 OS Credential Dumping Credential Access

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Cisco FMC Authentication Bypass and Web Shell Deployment
id: a7b3c9d1-e5f2-4a8b-9c6d-3e1f0a2b4c5d
status: experimental
description: Detects exploitation of Cisco Secure FMC CVE-2026-20079 (CVSS 10.0) authentication bypass and CVE-2026-20316 static credential abuse, including JSP web shell deployment and suspicious cmd.jar execution
references:
  - https://osintsights.com/cisco-fmc-exploits-fuel-ransomware-apt-attacks
  - https://blog.talosintelligence.com/
author: Tia N. List
date: 2026-09-11
tags:
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1100
  - attack.execution
  - attack.t1059
logsource:
  product: windows
  category: process_creation
detection:
  selection_jsp_shell:
    Image|endswith:
      - '\java.exe'
      - '\javaw.exe'
    CommandLine|contains:
      - 'F6C1F0E7'
      - 'cmd.jar'
      - 'OmniQuery'
  selection_fmc_script:
    Image|endswith:
      - '\perl.exe'
      - '\perl5.exe'
    CommandLine|contains:
      - 'package_info.pl'
      - 'license.tmp'
  selection_netcat:
    Image|endswith:
      - '\nc.exe'
      - '\netcat.exe'
    CommandLine|contains:
      - '-e'
      - '/bin/sh'
  condition: selection_jsp_shell or selection_fmc_script or selection_netcat
falsepositives:
  - Legitimate Cisco FMC administrative activity
level: critical

References

• https://osintsights.com/cisco-fmc-exploits-fuel-ransomware-apt-attacks
• https://blog.talosintelligence.com/