Loading threat actor…
UAT-11988 is a financially motivated cybercriminal intrusion cluster assessed with high confidence to be a Qilin ransomware affiliate or operator. The group targeted Cisco Secure Firewall Management Center (FMC) systems, obtaining initial access through the static-credential vulnerability CVE-2026-20316. It abused legitimate FMC administrative tooling to execute attacker-controlled code with root privileges and conducted living-off-the-land post-compromise activity. UAT-11988 performed extensive reconnaissance of victim environments, harvested Active Directory service-account and MySQL credentials, enumerated domain infrastructure, and identified high-value systems including domain controllers, identity services, mail servers, file servers, and database servers. The actor staged and exfiltrated collected information, deployed SOCKS5 proxying and reverse-SSH tunnels, and forwarded enterprise authentication and remote-management protocols to pivot into internal networks. Post-exploitation tooling included Impacket, Invoke-TheHash, and tools intended to disable endpoint security products. The operation ultimately deployed Qilin ransomware to encrypt selected endpoints.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
28 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
Cisco disclosed CVE-2026-20316 as a separate FMC vulnerability involving static credentials. UAT-11988, a Qilin ransomware operator, reportedly exploited it for initial access before reconnaissance, credential theft, defense evasion, and ransomware deployment.
Cisco Secure Firewall Management Center (FMC) contains an unauthenticated authentication-bypass vulnerability that can result in root access to the underlying appliance. Cisco confirmed active exploitation beginning in August 2026.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware operation that used the FMC low-privilege authentication vulnerability for initial access, performed reconnaissance and credential collection, disabled security tools, and deployed Qilin ransomware.
A ransomware operation exploiting Cisco FMC CVE-2026-20316 for initial access, conducting reconnaissance and credential collection with built-in FMC tooling, maintaining access through tunneling tools, disabling security tools, and deploying Qilin ransomware against selected systems.
A Qilin-associated ransomware intrusion cluster conducting Cisco FMC exploitation, reconnaissance, credential theft, security-tool disabling, and ransomware deployment.
Cluster cybercriminel opérant le ransomware Qilin. Il abuse d’un script exécuté avec les privilèges root, effectue une reconnaissance Active Directory et MySQL, établit un proxy SOCKS5 et un tunnel SSH inverse, puis déploie Qilin.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.