Loading threat actor…
UAT-12197 is an unattributed intrusion cluster targeting Cisco Secure Firewall Management Center (FMC) systems. The cluster exploited CVE-2026-20079, an unauthenticated authentication-bypass vulnerability, to establish access and deploy JSP-based web shells. It subsequently installed a Java Archive-based command executor that queried internal FMC databases to collect user authentication data and stored credentials. Observed activity demonstrates exploitation of public-facing infrastructure, web-shell-based persistence, arbitrary command execution, and credential theft. No reliable attribution, country of origin, victim geography, industry focus, or broader operational objective has been established.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Exploits Cisco FMC CVE-2026-20079 to gain access, deploy JSP web shells and custom Java command executors, query internal databases, and harvest user authentication data and credentials.
Post-compromise activity cluster that used the FMC authentication-bypass flaw to search internal databases and collect user authentication data and credentials.
A threat cluster exploiting Cisco Secure Firewall Management Center authentication bypass CVE-2026-20079 to obtain root-level access, deploy web shells and a JAR command executor, and harvest internal database data and credentials.
Exploits Cisco Secure Firewall Management Center CVE-2026-20079 and deploys JSP web shells and a malicious JAR for credential harvesting.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.