Brave AI search 9/9/2026
UAT-12197 is an opportunistic, financially motivated threat actor tracking designation assigned by Cisco Talos. The group specializes as an initial access broker and credential thief, explicitly operating within the campaign targeting Cisco Secure Firewall Management Center (FMC) appliances.
While other clusters in the campaign focused on state-sponsored espionage (UAT-11823 / Sandworm) or final enterprise encryption (UAT-11988 / Qilin ransomware), UAT-12197\\\\\\\'s specific objective is credential harvesting and selling enterprise access on criminal marketplaces.
Kill Chain & Attack Methodology
UAT-12197 leverages a specific web-focused toolkit to drain administrative secrets from the appliance:
• Initial Access: The group exploits CVE-2026-20079, a maximum-severity (CVSS 10.0) unauthenticated remote code execution vulnerability stemming from a boot-time process flaw. This yields instant root privileges on the underlying operating system.
• Web Shell Deployment: Once root access is achieved, they drop a JSP-based web shell named home.jsp into the CSM Tomcat webroot directory to maintain stable, interactive remote control via a web interface.
• The Command Executor (cmd.jar): Using the web shell, they upload a custom Java Archive tool called cmd.jar.
• Database Credential Exfiltration: They execute cmd.jar to systematically query the local Cisco FMC database using the device\\\\\\\'s internal query tool
(OmniQuery.pl). Their main command executes the following string to dump plaintext parameters and hash structures:
/var/jre/bin/java -jar cmd.jar \\\\\\\'/var/sf/bin/OmniQuery.pl -db mdb -e \\\\\\\"SELECT name, auth_data FROM users;\\\\\\\"\\\\\\\'
Organizations compromised by UAT-12197 are highly vulnerable to secondary extortion attacks because stolen authentication profiles are often held or traded to third-party criminal affiliates who deploy final malware weeks later.
The authoritative host and file-based Indicators of Compromise (IoCs) published by Cisco Talos to audit and detect the UAT-12197 web shells and toolsets on Cisco FMC appliances are detailed below.
1. File Indicators (SHA-256 Hashes)
Search your local filesystem, endpoint detection tools, or integrity management software for the following specific file hashes:
SHA-256 Hash File Name Description / Classification
b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d home.jsp JSP-based interactive web shell dropped for initial persistence.
db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e cmd.jar Java archive file used to bypass restrictions and run internal system commands.
2. Specific Web Detection Markers
To check the web interface subsystem for traces of UAT-12197, audit your CSM Tomcat webroot directory and active logging streams for these explicit patterns:
Unauthorized Webroot Files
Review the local filesystem paths for newly introduced or modified files under the application directory structure:
• */tomcat/webapps/ROOT/home.jsp
• */tomcat/webapps/ROOT/cmd.jar
Command Execution Trailing
Look for instances in process creation logs, bash histories, or SIEM audit captures where the Java runtime environment (java -jar) explicitly references the cmd.jar file to communicate with the local database engine via OmniQuery.pl:
bash Use code with caution.
/var/jre/bin/java -jar cmd.jar \\\\\\\'/var/sf/bin/OmniQuery.pl -db mdb -e \\\\\\\"SELECT name, auth_data FROM users;\\\\\\\"\\\\\\\'
Note: A legitimate system process will not wrap OmniQuery.pl execution parameters inside a Java-based runtime application format.
Web Log URI Inbound Patterns
Analyze incoming HTTP server access logs for anomalous POST requests or targeted parameters aimed at executing backend payloads:
• Target URI: Any request targeting /home.jsp or files within raw root application paths.
• Query String Component: Inbound payloads carrying commands tied to local system binaries (e.g., executing sh, bash, java, or querying native .pl scripts).
Updates from Cisco Talos and the Cloud Security Alliance (CSA) highlight several highly specific technical and strategic parameters regarding this cluster that haven\\\\\\\'t been mentioned yet:
1. The Core Web Shell Parameter: F6C1F0E7
Deep technical analysis reveals that the JSP web shell deployed by UAT-12197 is not static. It operates by dynamically loading arbitrary Java payload classes directly into memory.
• The Marker: The web shell processes code execution by explicitly looking for an incoming Base64-encoded parameter labeled exactly F6C1F0E7.
• The Method: When it decodes this specific parameter string, it extracts the target class name to inject and load directly inside the running JAVA process (Tomcat). This completely bypasses traditional file-creation monitoring because additional custom binaries do not need to hit the physical disk to execute.
2. The Internal Mechanics of cmd.jar
The tool cmd.jar has a hardcoded configuration designed to drop execution straight out to the system shell using /bin/sh -c. This means if the web interface shell drops cmd.jar, it isn\\\\\\\'t executing abstract sandbox commands; it is explicitly granting the threat actor native operating system terminal control natively wrapped inside legitimate Tomcat application processes.
3. Tradecraft Sophistication Assessment
Threat analysts from the CSA explicitly evaluated UAT-12197 as having the lowest level of operational sophistication among all clusters active in this campaign.
• Unlike UAT-11823 (Sandworm), which deployed complex kernel-level persistent implants (Cyclops Blink) and exfiltrated device-by-device configuration nodes, UAT-12197 used no post-compromise privilege escalation.
• They relied entirely on the absolute, pre-baked root access naturally provided by the unauthenticated CVE-2026-20079 flaw. This highlights them as purely opportunistic, fast-moving threat actors taking immediate advantage of a zero-day exploit rather than developing a custom post-exploitation kit.
4. Direct Infrastructure Disconnection
Telemetry monitoring confirms that the digital infrastructure, scanning points, and proxy systems deployed by UAT-12197 share zero technical overlap with the other two clusters. This confirms that multiple threat profiles (from state espionage to credential harvesting) discovered the vulnerability concurrently and hit the exact same enterprise firewalls independently within days of each other.
The Threat Codex https://threatcodex.com/
UAT-12197 Threat Actor
Description
An activity cluster that exploits vulnerabilities to deploy JSP web shells and Java Archive (JAR)–based command execution tools to harvest credentials and exfiltrate authentication data.
Other Names
UAT-12197 (Cisco)
Last Active- 2026-09-15
Malware & Tools Used- Unknown
Exploited Services- None
Exploited Vulnerabilities-
CVE-2026-20316 - https://threatcodex.com/index.php?search=CVE-2026-20316
CVE-2026-20079 - https://threatcodex.com/index.php?search=CVE-2026-20079
Recent Publications-
2026-09-09 Active exploitation of Cisco Secure Firewall Management Center vulnerabilities https://blog.talosintelligence.com/fmc-ongoing-exploitation/
Targeted Sectors- Unknown
Targeted Countries-- Unknown
Autonomous Systems-None Observed
Tactics, Techniques, and Procedures-
Reconnaissance- (None Observed)
Resource Development- (None Observed)
Initial Access-
ID Name First Seen Last Seen
T1190 Exploit Public-Facing Application 2026-09-15 2026-09-15
Execution- (None Observed)
Persistence-(None Observed)
Privilege Escalation-(None Observed)
Defense Evasion- (None Observed)
Credential Access- (None Observed)
Discovery- (None Observed)
Lateral Movement- (None Observed)
Collection- (None Observed)
Command and Control- (None Observed)
Exfiltration- (None Observed)
Impact- (None Observed)
