Google\\Brave AI search 10/8/2026

UAT-11988 is a threat actor tracked by Cisco Talos, assessed with high confidence to be a Qilin ransomware operator. It gained initial access to Cisco Secure Firewall Management Center (FMC) devices by exploiting the static-credentials vulnerability CVE-2026-20316, then conducted a living-off-the-land intrusion: abusing the built-in package_info.pl utility to run a malicious license.tmp file with root privileges for reconnaissance, harvesting Active Directory and MySQL credentials, building a target endpoint list, staging a SOCKS5 proxy and reverse-SSH tunnel (forwarding LDAP, Kerberos, SMB, and WinRM ports), deploying AV killers, and ultimately deploying Qilin ransomware on selected endpoints.

The cyber security context of UAT-11988 centers on a critical exploit vector involving network infrastructure and corporate extortion.

Explicitly tracked by threat intelligence groups (specifically Cisco Talos) as a financially motivated threat actor operating as an active Qilin ransomware affiliate.

While other threat groups (like the state-sponsored cluster UAT-11823) targeted the exact same security flaws for espionage and long-term persistence (such as deploying the Cyclops Blink implant), UAT-11988\'s sole relationship to this campaign was the rapid monetization and extortion of victims using the Qilin ransomware strain.

**In September 2026, Cisco Talos disclosed that UAT-11988 was one of three distinct malicious clusters actively exploiting vulnerabilities in the Cisco Secure Firewall Management Center (FMC).

Key details:

* Motivation: Ransomware-as-a-service (extortion via encryption + data theft)

* Known attacker IP: 43.204.2.142

The group was identified and publicly tracked by Cisco Talos following a series of sophisticated, targeted attacks against enterprise networks.

Modus Operandi & Attacks-

UAT-11988 gained notoriety for actively exploiting critical vulnerabilities in Cisco Secure Firewall Management Center (FMC) systems. Their attack strategy typically involves the following progression:

• Initial Access: The threat actor circumvents standard perimeters by logging into FMC systems via a static, hard-coded credentials vulnerability (CVE-2026-20316).

• Living-off-the-Land (LOTL): Instead of immediately installing obvious malware, UAT-11988 abuses legitimate, built-in Cisco FMC administration tooling to conduct extensive internal reconnaissance undetected.

* Reconnaissance & Living off the Land: Once inside, they abuse built-in, legitimate FMC utilities to map out the victim\'s internal network, enumerate Active Directory domains, and harvest credentials (including Active Directory and MySQL data).

* Persistence & Proxying: They deploy SOCKS5 proxies and reverse SSH tunnels to maintain steady network access.

* Deployment: After using custom tools to kill endpoint antivirus software, they build a target list of endpoints and ultimately deploy Qilin ransomware to encrypt the victim\'s systems.

* Infiltration Tunneling: Creating Python SOCKS5 proxies and reverse SSH tunnels to forward authentication traffic (Ports 389, 636, 88, 445, etc.) back to their servers.

* Execution: Manually deploying custom process-termination tools to kill localized endpoint security and antivirus products right before pushing the Qilin ransomware executable to lock network endpoints.

• Credential Theft & Domain Mapping: They harvest internal database and network management passwords, mapping out directory structure parameters like Active Directory (AD) and MySQL servers.

• Network Tunneling: The group builds reverse-SSH tunnels and SOCKS proxies to route internal enterprise traffic smoothly back to their external command-and-control infrastructure.

• Payload Execution: After creating a comprehensive target list of domain controllers and file servers, they disable endpoint security software and deploy the Qilin ransomware payload to lock down the network for extortion.

Context of the Group-

Because threat intelligence agencies use the UAT (Uncategorized Threat) prefix to track newly discovered or unclassified clusters of malicious activity, \"UAT-11988\" represents the specific tracking label for this campaign before it is permanently merged into a larger, designated Advanced Persistent Threat (APT) profile. During these FMC exploitation campaigns, UAT-11988 was observed striking systems concurrently alongside other sophisticated groups, such as the Russian-nexus APT Sandworm (tracked as UAT-11823).

Cisco has since issued hotfixes to patch these entry points, and network defenders are advised to isolate management interfaces on dedicated VLANs.

🛡️ The Threat Profile-

• Attribution: Cisco Talos tracks UAT-11988 with high confidence as a ransomware operator acting as an affiliate for the notorious Qilin ransomware family.

• The \"UAT\" Designation: The prefix stands for Uncategorized Threat. It is a placeholder label used by threat intelligence teams to quarantine, monitor, and document a newly active cluster of malicious behaviors before officially cataloging them under an established Advanced Persistent Threat (APT) group.

💻 Target and Vulnerability (CVE-2026-20316)-

UAT-11988 gained high visibility during targeted campaigns exploiting Cisco Secure Firewall Management Center (FMC) systems.

• Rather than relying on standard phishing lures, they bypassed traditional network perimeters by exploiting CVE-2026-20316.

• This flaw allows attackers to utilize hardcoded static credentials to log directly into exposed low-privileged accounts on the FMC appliance. Once inside, they chain it with other system behaviors to elevate their access to a root level.

Tactics, Techniques, and Procedures (TTPs)-

The actions taken by UAT-11988 inside compromised networks align perfectly with the standard playbook of known Qilin affiliates. After establishing a foothold, they focus heavily on double-extortion tactics: harvesting critical domain directories followed by network-wide encryption. 

The group uses highly methodical \"Living-off-the-Land\" (LOTL) methods to remain hidden while prepping a target network for total encryption:

• Internal Reconnaissance: They abuse legitimate administrative tools built straight into Cisco FMC to enumerate Active Directory (AD), locate SQL database backups, and map domain controllers.

• Traffic Tunneling: To avoid triggering network anomalies, they stand up SOCKS5 proxies and reverse-SSH tunnels. This safely blends their data extraction and command communication into normal enterprise traffic profiles.

• Credential Dumping: The cluster uses standard administrative tools (such as Impacket and Invoke-TheHash) to harvest high-level credentials across the target domain.

• Incapacitation & Ransom: After building a definitive target list of critical endpoints, they deploy specialized, custom security-killing scripts to disable local Antivirus software right before executing the final Qilin ransomware payload to lock down the enterprise.

⚠️ Broader Network Impact

A breach of an FMC system is severe because it controls the configuration of all underlying network firewalls. By owning the management plane, UAT-11988 essentially transforms an organization’s primary defense perimeter into their private launching pad for lateral corporate movement.

If you are a system administrator checking for this threat, Cisco has released official security hotfixes. It is highly advised to pull FMC units behind a secure VPN/ZTNA barrier and check local directory pathways for anomalous static-credential usage or unauthorized outbound SSH tunnels.

How does UAT-11988 differ from Sandworm?

Here\'s how the two clusters differ across the key dimensions:

Dimension                                 UAT-11988 (Qilin)                                                 UAT-11823 (Sandworm)

Attribution      Ransomware-as-a-service affiliate (Qilin)        State-sponsored APT; tooling overlaps with Sandworm (Russian GRU Unit 74455)

Motivation      Financial extortion (encryption + data theft)   Espionage — persistent access & configuration exfiltration

Initial Access    CVE-2026-20316 only (static credentials)          Both CVE-2026-20079 (CVSS 10.0 auth bypass) and CVE-2026-20316

Post-Compromise Style         Living-off-the-land —                                      minimal custom malware, heavy use of legitimate FMC tooling

Custom malware deployment — Netcat reverse shell, bash scripts,                 Cyclops Blink ELF implant

Key Techniques AD/MySQL credential harvesting, Python SOCKS5 proxy, reverse-SSH tunneling (LDAP/Kerberos/SMB/WinRM), Impacket, Invoke-TheHash, AV killer        Netcat reverse shell, managed-firewall configuration harvesting via bash scripts, Cyclops Blink (packet sniffing, command execution, file transfer, DNS-over-HTTPS)

End Goal Deploy Qilin ransomware on selected endpoints             Maintain long-term backdoor for ongoing intelligence collection

Known C2 IP                      43.204.2.142                                            89.34.96.56, 208.123.119.215, 91.214.78.118

In short: UAT-11823 is a patient, espionage-driven intrusion that plants a custom backdoor (Cyclops Blink) to sit quietly and collect data over time, while UAT-11988 is a fast-moving, financially motivated operation that uses the FMC as a recon platform, then pivots to encrypt and exfiltrate — a textbook ransomware affiliate playbook with little to no custom malware. 

The authoritative Indicators of Compromise (IoCs) published by Cisco Talos regarding the exploitation of Cisco Secure Firewall Management Center (FMC) appliances span across three threat clusters, including UAT-11988.

Network Indicators (Attacker IPs)

IP Address                      Cluster Attribution Description / Role

43.204.2[.]142             UAT-11988                           Attacker intrusion IP used to conduct exploitation and deploy Qilin ransomware

89.34.96[.]56             UAT-11823                           NetCat-based reverse shell C2 (Cyclops Blink)

208.123.119[.]215             UAT-11823                           NetCat-based reverse shell C2

91.214.78[.]118             UAT-11823                          NetCat-based reverse shell C2

104.218.165[.]253             UAT-11823                         Vulnerability scanning infrastructure targeting CVE-2026-20079

Host & File Indicators (SHA-256 Hashes)

SHA-256 Hash Cluster Attribution                                                            File Name / Description

b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d                        UAT-12197    home.jsp – Web shell deployed for persistence

db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e                UAT-12197    cmd.jar – Java-based arbitrary command executor

6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461                UAT-11823    Cyclops Blink malware payload

Observed Attack Paths & Behavioral TTPs

Because UAT-11988 heavily favors living-off-the-land (LOTL) techniques, look for the following behavioral anomalies on your FMC appliances:

• Targeted URI Requests: Attacker HTTP requests routing through /ui/user/general, /login.cgi?logon=Continue, /pjb.cgi, or /sajaxintf.cgi?rs=callServerFunc.

• File Integrity Monitoring: Check for unexpected file manipulation in the directory paths /var/tmp/license.tmp or activity executing via package_info.pl.

• Database Querying: Investigate unexpected local queries parsing the FMC database for user authentication schemas, session tokens, or password configurations.

• Network Tunnelling: Look for outbound connections from the FMC segment mapping to enterprise networks over LDAP, Kerberos, SMB, and WinRM ports, which UAT-11988 targeted using reverse SSH tunnels.

The full, ongoing list of structural payloads is updated directly on the Cisco Talos GitHub Repository.