eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Interlock Ransomware Group Exploited Cisco Vulnerability in Zero-Day Attacks
Bottom Line: The Interlock ransomware group was identified exploiting a critical vulnerability within Cisco Secure FMC, making it a zero-day vulnerability that is under active exploitation. Organizations should prioritize patching as soon as possible.
On March 18th, 2026, Amazon disclosed a ransomware campaign attributed to the Interlock ransomware group that is targeting enterprise environments through the exploitation of a critical vulnerability in Cisco Secure Firewall Management Center (FMC) software. The campaign centers on CVE-2026-20131, a critical vulnerability in Cisco Secure FMC that enables unauthenticated remote code execution. The flaw allows attackers to send specially crafted HTTP requests to a vulnerable application endpoint, resulting in the execution of attacker-supplied Java code as the root user. The exploitation activity was identified through Amazon’s MadPot global honeypot sensor network.
Observed exploitation attempts included HTTP requests containing embedded Java execution logic as well as multiple attacker-controlled URLs. One URL was used to retrieve configuration data necessary for the exploit to succeed, while another was used to confirm successful exploitation by forcing the compromised system to perform an outbound HTTP PUT request containing a generated file. Interlock issued commands to download and execute a malicious ELF binary from an attacker-controlled server. Analysis of the staging infrastructure revealed that the same server was used to distribute the group’s full range of operational tools.
Interlock deployed a PowerShell-based reconnaissance script designed to systematically enumerate Windows environments. The script collected detailed information about operating systems, hardware configurations, running services, installed software, storage layouts, and Hyper-V virtual machines. It also gathered extensive user-level data, including file listings from Desktop, Documents, and Downloads directories, as well as browser artifacts from multiple browsers such as Chrome, Edge, Firefox, and Internet Explorer.
The group employed a custom Remote Access Trojan (RAT) to maintain persistent control over compromised systems. One variant was implemented as an obfuscated JavaScript implant that suppressed browser console output to evade basic inspection. Upon execution, the implant profiled the infected system using PowerShell and Windows Management Instrumentation before initiating encrypted Command-and-Control (C2) communications over persistent WebSocket connections. In addition, Interlock deployed a memory-resident Java webshell that achieved persistence without writing malicious files to disk. The campaign also involved the deployment of legitimate commercial and open-source tools alongside custom malware. Interlock deployed ConnectWise ScreenConnect for persistent remote access. They also used Volatility to extract credentials and sensitive data, along with Certify to exploit misconfigurations in Active Directory Certificate Services.
eSentire Threat Intelligence Analysis:
Amazon researchers determined that Interlock began exploiting the vulnerability on January 26th, 2026, providing the group with at least 36 days of undetected access before public disclosure. The eSentire Threat Intelligence team initially published a security advisory addressing CVE‑2026‑20131 on March 4th, 2026, in which the likelihood of near-term exploitation was assessed as high. The ongoing exploitation of CVE‑2026‑20131 poses a severe enterprise risk due to the privileged position of Cisco FMC within network security architectures. A compromised FMC instance can be used to undermine firewall policies, disable security monitoring, facilitate lateral movement, and enable ransomware deployment across managed devices. Given Interlock’s established double‑extortion tactics, affected organizations face a high likelihood of both data theft and operational disruption. For a detailed analysis of Interlock’s Tactics, Techniques, and Procedures (TTPs), the eSentire Threat Response Unit (TRU) published a blog titled “Unmasking Interlock Group's Evolving Malware Arsenal.”
Organizations running Cisco Secure FMC are strongly advised to apply Cisco’s security patches for CVE-2026-20131 without delay. Security teams should review historical logs for indicators associated with this campaign, audit remote access tool deployments for unauthorized installations, and conduct thorough compromise assessments where exposure is suspected.
In response to the release of this report, the eSentire Threat Intelligence team published a security advisory addressing CVE‑2026‑20131 on March 19th, 2026, which includes detailed response actions and defensive recommendations. eSentire Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2026-20131. The team has also detailed the Security Advisory Bundled Publication for March 2026 – Cisco in the Weekly Threat Briefing covering March 2–6, 2026. This report provides additional technical context and mitigation guidance for multiple Cisco vulnerabilities, including CVE‑2026‑20079, CVE‑2026‑20122, and CVE‑2026‑20128.
2025 Ransomware Trends Identified
Bottom Line: According to a new Google report, ransomware operators are increasingly exploiting vulnerabilities in widely deployed VPNs, firewalls, and virtualization platforms while shifting toward data theft–driven extortion, as declining ransom profitability reshapes the threat landscape.
On March 16th, 2026, Google Threat Intelligence published a ransomware trends report, based on investigations into ransomware incidents conducted by Mandiant Consulting throughout 2025. The report highlights common initial access vectors and Tactics, Techniques, and Procedures (TTPs) used within ransomware attacks in 2025, along with providing an overview of the ransomware landscape for the year. Google highlights that the data taken for this analysis comprises of ransomware incidents from the Asia Pacific region, Europe, North America, and South America, and in “nearly every industry sector”.
In one-third of ransomware incidents, Google indicates that the initial access vector was vulnerability exploitation, with VPNs and firewalls being the most targeted devices. Specific devices that were targeted include, but not limited to, Fortinet (CVE-2024-21762, CVE-2024-55591, CVE-2019-6693), SonicWall (CVE-2024-40766), Citrix (CVE-2023-4966), Palo Alto (CVE-2024-3400), Microsoft SharePoint (CVE-2025-53770, CVE-2025-53771), and SAP NetWeaver (CVE-2025-31324). Initial access was also achieved through web compromises, such as malvertising and Search Engine Optimization (SEO) Poisoning, brute force attacks, and using stolen credentials. Once access was achieved, Google notes that threat actors made use of valid credentials, Remote Monitoring and Management (RMM) tools, and backdoor and tunneler malware (which saw an increase in usage compared to 2024) for persistence. The usage of post-exploitation frameworks such as AdaptixC2, Beacon, and Mythic were identified, but in less numbers compared to previous years. In 77% of cases, Google indicates that data theft was identified, compared to 57% of ransomware incidents in 2024, and was commonly achieved through legitimate data synchronization tools, including Rclone, MEGASync, Filezilla, and WinSCP.
The most common ransomware strain identified by Google in 2025 was RedBike (aka Akira), which they indicate was observed in 28% of incidents. This was followed by Agenda in 11% of cases, and INC in 9%. In terms of the overall ransomware landscape in 2025, Google states that posts on Data Leak Sites (DLSs) increased by 50% compared to 2024. DLSs are sites where ransomware actors will post stolen data if organizations fail to meet the ransom demands. The top three groups who posted to their DLSs in 2025 were identified as Qilin, Akira, and CL0P.
eSentire Threat Intelligence Analysis:
Google states that over the past several years, the overall profitability of the ransomware ecosystem has declined, with potential causes being improved cybersecurity practices, increased ability for organizations to recover from attacks, declining ransom payments, and external factors such as disruptions of ransomware operations or internal conflicts. Regarding recovery, Unit 42 notes that between 2022 and 2024, the percentage of ransomware victims who were able to restore encrypted files from backups rose by 360%. In terms of payments, statistics indicate a decline over the past several years, where the ransom was paid in approximately 85% of attacks in 2019 compared to around 25% by 2025. So, while ransomware attacks appear to still be increasing year over year, statistics indicate that ransom payments are on a downwards trend, which could be linked to the increase in posts on DLSs that Google identified.
Google claimed that 77% of incidents investigated involved data exfiltration, which along with ransomware deployment, makes up the double-extortion method. This appears to be a significant increase compared to 2024, where only 57% of incidents involved data theft. The increase in data theft could also be attributed to better backup practices by organizations but may also be in response to increased government scrutiny against ransomware groups. An example of this is the group Hunters International, who rebranded to World Leaks in 2025 and switched to an extortion-only model due to higher law enforcement scrutiny and a decrease in ransom payments. Another group that has also made the shift to extortion only attacks is BianLian, while groups like CL0P swap between extortion-only and double-extortion tactics. It is likely that extortion-only attacks will continue to increase in the coming years.
The most common identified method for gaining initial access identified by Google involved the exploitation of vulnerabilities within VPNs, firewalls, and other externally facing devices, which are known to be targeted within attacks. Other access methods included brute force attacks, and leveraging stolen credentials. To protect against these threats, organizations should ensure that a robust patch management policy is in place, to quickly identify and patch vulnerable edge devices. Strong passwords should also be enforced, and Multi-Factor Authentication (MFA) and Conditional Access policies should be applied where feasible to limit the impact of stolen credentials.
EU Sanctions Chinese & Iranian Firms for Cyberattacks
Bottom Line: The EU has imposed sanctions on three entities and two individuals, from China and Iran, for supporting or conducting large scale cyberattacks that impacted critical EU infrastructure.
On March 16th, 2026, the Council of the European Union (EU) formally enacted sanctions targeting two Chinese companies, one Iranian company, and two Chinese individuals. These restrictive measures are in response to a series of cyberattacks on EU member states’ devices, critical infrastructure, and information systems.
The sanctioned Chinese companies are Integrity Technology Group and Anxun Information Technology (i-Soon). Integrity Technology Group “provided products used to compromise and access devices” resulting in more than 65,000 compromised devices across six EU member states. In January 2025, the U.S. Department of Treasury announced sanctions against Integrity Technology Group, confirming that they had publicly been reported on as the known APT Flax Typhoon. i-Soon “provided hacking services aimed at the critical infrastructure and critical functions of member states and third countries”. In March 2025, U.S. officials described i-Soon as "a key player in the PRC's hacker-for-hire ecosystem." Two co‑founders of the company were also sanctioned for their direct role in attacks affecting EU countries.
The sanctioned Iranian entity is Emennet Pasargad (Aria Sepehr Ayandehsazan). The company is attributed to multiple cyber-operations including unauthorized access to a French subscriber database, the compromise of Swedish SMS services, and digital billboard hijacking during the 2024 Paris Olympics to spread disinformation. According to the FBI, Emennet Pasargad has previously been tracked as Haywire Kitten, and commonly performs hack-and-leak operations to cause reputational damage against targets.
All sanctioned organizations and individuals are now subject to:
eSentire Threat Intelligence Analysis:
The EU’s coordinated move represents a significant escalation in its cyber deterrence strategy, signalling that the bloc is prepared to impose tangible consequences on state‑aligned entities exploiting the private sector to facilitate cyber operations. By sanctioning both organizations and individual executives, the EU is adopting a more aggressive attribution model that directly holds leadership accountable. Sanctions no longer focus solely on the technical operators but the corporate governance layer that enables offensive cyber services; this mirrors escalatory measures seen in U.S. and U.K. sanctions. While these sanctions may result in financial losses, the impacted organizations likely rely on domestic government contracts, as such, continued activity should be expected in the near-term.
In parallel with the EU sanctions, the U.S. Justice Department seized four domains associated with the Iranian threat actor group Handala. These domains were explicitly tied to Iran’s Ministry of Intelligence and Security (MOIS) and were used to amplify the Stryker attack and other disruptive campaigns. The parallel U.S.–EU actions underscore increasing international symmetry on limiting Iran’s ability to conduct cyber-enabled coercion via deniable front groups, which are state sponsored groups that impersonate hacktivists or non-governmental threat actors. It should be noted that CISA has provided recommendations for defending against attacks similar to the destructive activity which impacted Stryker. For more information on the Handala group and the attack against Stryker, see eSentire’s March 13th, Weekly Threat Briefing.
Coupled with the increased risk of Iranian threat activity related to the ongoing conflict, organizations operating in sensitive sectors, including telecommunications, critical infrastructure, media, and government supply chains, should assume increased exposure to Chinese and Iranian cyber‑enabled operations.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
