Security News > 2021 > April > Hackers Exploit Fortinet Flaw in Sophisticated Cring Ransomware Attacks

"In at least in one case, an attack of the ransomware resulted in a temporary shutdown of the industrial process due to servers used to control the industrial process becoming encrypted," Kaspersky senior security researcher Vyacheslav Kopeytsev wrote in the report.

One of those bugs, is CVE-2018-13379, a path-traversal flaw in Fortinet FortiOS. The vulnerability is tied to system's SSL VPN web portal and allows an unauthenticated attacker to download system files of targeted systems via a specially crafted HTTP resource requests.

In its report Kaspersky echoed the feds' warning adding attackers are first scanning connections to Fortinet VPNs to see if the software used on the device is the vulnerable version.

After gaining complete control, attackers download a cmd script to launch Cring ransomware, naming the malicious execution script "Kaspersky" to disguise it as a security solution, Kopeytsev said.

In its final step, Cring starts to encrypt files using strong encryption algorithms so victims can't decrypt files without knowing the RSA private key held by the attackers, Kopeytsev explained.

"The primary causes of the incident include the use of an outdated and vulnerable firmware version on the Fortigate VPN server, which enabled the attackers to exploit the CVE-2018-13379 vulnerability and gain access to the enterprise network," he wrote.

News URL

https://threatpost.com/hackers-exploit-flaw-cring-ransomware/165300/