Interlock ransomware gang exploited Cisco firewall zero-day weeks before disclosure: Amazon

Amazon Integrated Security reported that the Interlock ransomware gang exploited a zero-day in Cisco Secure Firewall Management Center (CVE-2026-20131) in January—weeks before public disclosure—using a misconfigured staging server that exposed custom malware, reconnaissance and evasion tools, and their ransom note/negotiation portal; the group has targeted governments, healthcare, and schools, causing significant operational impact and data exposure.