Zero-Day Vulnerability Suspected in Attacks on Fortinet Firewalls with Exposed Interfaces

Category	Details
Threat Actors	Unknown threat actors (potentially multiple individuals/groups)
Campaign Overview	Unauthorized access to Fortinet FortiGate firewalls with exposed management interfaces; configuration changes and credential extraction via DCSync.
Target Regions	Global (victim organizations across various sectors and sizes)
Methodology	Exploitation of zero-day vulnerability, unauthorized administrative logins, configuration changes, SSL VPN access, lateral movement via DCSync.
Products Targeted	Fortinet FortiGate firewall devices with exposed management interfaces.
Malware Reference	DCSync (for credential extraction)
Tools Used	jsconsole interface, VPS hosting providers (for VPN tunnels)
Vulnerabilities Exploited	Likely zero-day vulnerability in Fortinet FortiGate firewall firmware (versions 7.0.14-7.0.16).
TTPs	Scanning, reconnaissance, credential extraction, lateral movement, VPN tunnel establishment.
Attribution	Unspecified, but likely multiple individuals/groups involved based on infrastructure differences.
Recommendations	Do not expose firewall management interfaces to the internet; restrict access to trusted users.
Source	The Hackers News

Read full article: https://thehackernews.com/2025/01/zero-day-vulnerability-suspected-in.html

The above summary has been generated by an AI language model