Security News > 2021 > April > New Cring ransomware hits unpatched Fortinet VPN devices

A vulnerability impacting Fortinet VPNs is being exploited by a new human-operated ransomware strain known as Cring to breach and encrypt industrial sector companies' networks.

The Cring operators drop customized Mimikatz samples, followed by CobaltStrike after gaining initial access and deploy the ransomware payloads by downloading using the legitimate Windows CertUtil certificate manager to bypass security software.

As Kaspersky researchers revealed in a report published today, the attackers exploit Internet-exposed Fortigate SSL VPN servers unpatched against the CVE-2018-13379 vulnerability, which allows them to breach their targets' network.

From the Fortinet VPN appliance, Cring operators move laterally on the targets' enterprise network stealing Windows user credentials using Mimikatz to gain control of the domain administrator account.

The ransomware payloads are then delivered to devices on the victims' networks using the Cobalt Strike threat emulation framework deployed using a malicious PowerShell script.

The ransomware encrypts only specific files on the compromised devices using strong encryption algorithms after removing backup files and killing Microsoft Office and Oracle Database processes.

News URL

https://www.bleepingcomputer.com/news/security/new-cring-ransomware-hits-unpatched-fortinet-vpn-devices/