Security News > 2023 > March > Fortinet zero-day attacks linked to suspected Chinese hackers
A suspected Chinese hacking group has been linked to a series of attacks on government organizations exploiting a Fortinet zero-day vulnerability to deploy malware.
The security flaw allowed threat actors to deploy malware payloads by executing unauthorized code or commands on unpatched FortiGate firewall devices, as Fortinet disclosed last week.
The firewalls were compromised using a CVE-2022-41328 FortiGate path traversal exploit, and their simultaneous shutdown led Fortinet to suspect the attack originated from a FortiManager device.
The company said these were highly targeted attacks against government networks and large organizations, with the attackers also showcasing "Advanced capabilities," including reverse-engineering the FortiGate devices' operating system.
While jointly investigating the incident with Fortinet, Mandiant found that, after breaching the Fortinet devices, UNC3886 backdoored them using two new malware strains for continued access to the victims' networks: a Python-based Thincrust backdoor and the ICMP port-knocking Castletap passive backdoor.
On devices configured to restrict access from the Internet, the attackers installed a traffic redirector and a passive backdoor after pivoting from FortiGate firewalls previously backdoored using Castletap.
News URL
Related news
- Fortinet Warns of New Zero-Day Used in Attacks on Firewalls with Exposed Interfaces (source)
- Chinese Hackers Exploit MAVInject.exe to Evade Detection in Targeted Cyber Attacks (source)
- Miscreants 'mass exploited' Fortinet firewalls, 'highly probable' zero-day used (source)
- Fortinet warns of auth bypass zero-day exploited to hijack firewalls (source)
- Hackers use FastHTTP in new high-speed Microsoft 365 password attacks (source)
- Fortinet fixes FortiOS zero-day exploited by attackers for months (CVE-2024-55591) (source)
- US sanctions Chinese firm, hacker behind telecom and Treasury hacks (source)
- Patch procrastination leaves 50,000 Fortinet firewalls vulnerable to zero-day (source)
- 48,000+ internet-facing Fortinet firewalls still open to attack (source)
- Hackers Exploit Zero-Day in cnPilot Routers to Deploy AIRASHI DDoS Botnet (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-03-07 | CVE-2022-41328 | Path Traversal vulnerability in Fortinet Fortios A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands. | 7.1 |