Cisco has documented three distinct FMC attack campaigns, including no-login root access, Sandworm-linked tooling and ransomware preparation. Patch exposed managers and investigate each cluster separately.