{"type":"bundle","id":"bundle--56e55f37-0dae-5728-8ae7-61988154b20a","objects":[{"type":"identity","spec_version":"2.1","id":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-01-01T00:00:00.000Z","modified":"2026-01-01T00:00:00.000Z","name":"CTI-Hermes Autonomous Agent","identity_class":"organization"},{"type":"vulnerability","spec_version":"2.1","id":"vulnerability--c15d6e36-044a-5fb3-be07-f364163e184c","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:37.183379Z","modified":"2026-09-11T22:24:37.183379Z","name":"CVE-2026-20079","description":"Authentication bypass vulnerability in Cisco Secure Firewall Management Center web interface allowing unauthenticated remote access.","external_references":[{"source_name":"cve","external_id":"CVE-2026-20079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20079"}]},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:37.183379Z","modified":"2026-09-11T22:24:37.183379Z","name":"Exploit Public-Facing Application","external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190/"}]},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--760e1a3a-e3f8-51cf-afa6-fd478f5b29d3","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:37.183379Z","modified":"2026-09-11T22:24:37.183379Z","name":"Unsecured Credentials","external_references":[{"source_name":"mitre-attack","external_id":"T1552","url":"https://attack.mitre.org/techniques/T1552/"}]},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--5e7f5769-c92e-537e-b498-ddd1a9bd440e","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:37.183379Z","modified":"2026-09-11T22:24:37.183379Z","name":"Data Encrypted for Impact","external_references":[{"source_name":"mitre-attack","external_id":"T1486","url":"https://attack.mitre.org/techniques/T1486/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5ae86d2-a001-53e5-b4f0-0fdef2465498","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:37.183379Z","modified":"2026-09-11T22:24:37.183379Z","name":"SIGMA: Cisco FMC Web Interface Authentication Bypass Attempt","indicator_types":["malicious-activity"],"pattern":"[network-traffic:dst_ref.value = 'Cisco FMC Web Interface Authentication Bypass Attempt']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-09-11T22:24:37.183379Z","confidence":95},{"type":"indicator","spec_version":"2.1","id":"indicator--78824258-65bc-55aa-a135-fdfd1f577c3f","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:37.183379Z","modified":"2026-09-11T22:24:37.183379Z","name":"YARA: Qilin_Ransomware_Note_Artifact","indicator_types":["malicious-activity"],"pattern":"[network-traffic:dst_ref.value = 'Qilin_Ransomware_Note_Artifact']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-09-11T22:24:37.183379Z","confidence":95},{"type":"relationship","spec_version":"2.1","id":"relationship--41ce2949-9038-5b87-a0c4-2f37366bb812","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:37.183379Z","modified":"2026-09-11T22:24:37.183379Z","relationship_type":"indicates","source_ref":"indicator--c5ae86d2-a001-53e5-b4f0-0fdef2465498","target_ref":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09"},{"type":"relationship","spec_version":"2.1","id":"relationship--6d89d4c3-5c89-5d96-98c8-99cb8240cd9b","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:37.183379Z","modified":"2026-09-11T22:24:37.183379Z","relationship_type":"indicates","source_ref":"indicator--c5ae86d2-a001-53e5-b4f0-0fdef2465498","target_ref":"attack-pattern--760e1a3a-e3f8-51cf-afa6-fd478f5b29d3"},{"type":"relationship","spec_version":"2.1","id":"relationship--245372a8-6b6f-5674-9c73-b7131cb7eb22","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:37.183379Z","modified":"2026-09-11T22:24:37.183379Z","relationship_type":"indicates","source_ref":"indicator--c5ae86d2-a001-53e5-b4f0-0fdef2465498","target_ref":"attack-pattern--5e7f5769-c92e-537e-b498-ddd1a9bd440e"},{"type":"relationship","spec_version":"2.1","id":"relationship--f5ef1fd3-b0b2-5745-baff-ca8e93c3f478","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:37.183379Z","modified":"2026-09-11T22:24:37.183379Z","relationship_type":"indicates","source_ref":"indicator--78824258-65bc-55aa-a135-fdfd1f577c3f","target_ref":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09"},{"type":"relationship","spec_version":"2.1","id":"relationship--a14f163e-1944-5c25-ac79-54cc7978edb1","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:37.183379Z","modified":"2026-09-11T22:24:37.183379Z","relationship_type":"indicates","source_ref":"indicator--78824258-65bc-55aa-a135-fdfd1f577c3f","target_ref":"attack-pattern--760e1a3a-e3f8-51cf-afa6-fd478f5b29d3"},{"type":"relationship","spec_version":"2.1","id":"relationship--ba7bcb16-d536-592c-a5bf-86f3a03e78f6","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:37.183379Z","modified":"2026-09-11T22:24:37.183379Z","relationship_type":"indicates","source_ref":"indicator--78824258-65bc-55aa-a135-fdfd1f577c3f","target_ref":"attack-pattern--5e7f5769-c92e-537e-b498-ddd1a9bd440e"},{"type":"relationship","spec_version":"2.1","id":"relationship--0a4f8cd6-92c9-5581-a513-66f17954fd31","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:37.183379Z","modified":"2026-09-11T22:24:37.183379Z","relationship_type":"targets","source_ref":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","target_ref":"vulnerability--c15d6e36-044a-5fb3-be07-f364163e184c"},{"type":"relationship","spec_version":"2.1","id":"relationship--11797274-829f-5d28-8e17-069a92b4376c","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:37.183379Z","modified":"2026-09-11T22:24:37.183379Z","relationship_type":"targets","source_ref":"attack-pattern--760e1a3a-e3f8-51cf-afa6-fd478f5b29d3","target_ref":"vulnerability--c15d6e36-044a-5fb3-be07-f364163e184c"},{"type":"relationship","spec_version":"2.1","id":"relationship--afc0b4da-6959-5d7e-8bf1-d83a0eb1df3c","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:37.183379Z","modified":"2026-09-11T22:24:37.183379Z","relationship_type":"targets","source_ref":"attack-pattern--5e7f5769-c92e-537e-b498-ddd1a9bd440e","target_ref":"vulnerability--c15d6e36-044a-5fb3-be07-f364163e184c"},{"type":"report","spec_version":"2.1","id":"report--f21df0d6-cc5d-58c0-8c05-edbfa0bb1381","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-11T22:24:37.183379Z","modified":"2026-10-30T14:12:12.207300Z","name":"Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware","description":"Cisco has warned that multiple threat clusters, including operators linked to the Qilin ransomware group and state-sponsored threat actors, are actively exploiting critical vulnerabilities in Cisco Secure Firewall Management Center (FMC). The primary attack vector is CVE-2026-20079 (CVSS 10.0), a remote unauthenticated authentication bypass flaw in the web management interface. Successful exploitation grants full administrative control over managed firewalls, enabling credential theft, security monitoring evasion, and network-wide ransomware deployment.","published":"2026-09-11T22:24:37.183379Z","report_types":["threat-report"],"object_refs":["identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","vulnerability--c15d6e36-044a-5fb3-be07-f364163e184c","attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","attack-pattern--760e1a3a-e3f8-51cf-afa6-fd478f5b29d3","attack-pattern--5e7f5769-c92e-537e-b498-ddd1a9bd440e","indicator--c5ae86d2-a001-53e5-b4f0-0fdef2465498","indicator--78824258-65bc-55aa-a135-fdfd1f577c3f","relationship--41ce2949-9038-5b87-a0c4-2f37366bb812","relationship--6d89d4c3-5c89-5d96-98c8-99cb8240cd9b","relationship--245372a8-6b6f-5674-9c73-b7131cb7eb22","relationship--f5ef1fd3-b0b2-5745-baff-ca8e93c3f478","relationship--a14f163e-1944-5c25-ac79-54cc7978edb1","relationship--ba7bcb16-d536-592c-a5bf-86f3a03e78f6","relationship--0a4f8cd6-92c9-5581-a513-66f17954fd31","relationship--11797274-829f-5d28-8e17-069a92b4376c","relationship--afc0b4da-6959-5d7e-8bf1-d83a0eb1df3c"],"confidence":95}]}