Security News > 2021 > April > Cring Ransomware Targets Industrial Organizations

At the beginning of 2021, the threat actors behind the Cring ransomware were observed launching numerous attacks on European industrial enterprises, forcing at least one organization to shut down a production site.

The initial vector of attack was later identified as CVE-2018-13379, a vulnerability in the FortiOS SSL VPN web portal that could allow unauthenticated attackers to download FortiOS system files.

The directory traversal vulnerability can be exploited to extract the session file of the VPN Gateway, thus allowing unauthenticated attackers to gain access to usernames and plaintext passwords.

The attacks observed by Kaspersky started with test connections to the VPN Gateway, to check the software version on the target devices, followed by the main attack phase several days later.

"Various details of the attack indicate that the attackers had carefully analyzed the infrastructure of the attacked organization and prepared their own infrastructure and toolset based on the information collected at the reconnaissance stage," Kaspersky says.

The FBI and CISA issued an alert last week to warn governmental, commercial, and technology services organizations about attacks targeting multiple vulnerabilities in FortiOS. Fortinet too once again urged customers to apply the available patches, to remain protected from attacks.

News URL

http://feedproxy.google.com/~r/Securityweek/~3/fTyTmtN4PPc/cring-ransomware-targets-industrial-organizations