Update now Fortinet Windows VPN hacked to steal user data

Date:
Tue, 19 Nov 2024 20:02:00 +0000

Description:
A months-old vulnerability, with no fix in sight, is being abused to grab VPN passwords.

FULL STORY ======================================================================Research ers spot Chinese threat actor stealing login credentials from Fortinet VPN Thefts carried out with the help of a vulnerability discovered in 2023 The
bug is yet to be addressed, or even assigned a CVE

Cybersecurity researchers has revealed that for months now, Fortinets Windows VPN client has been vulnerable to a flaw which allows threat actors to steal user credentials - and Chinese hackers have reportedly now started exploiting the bug and stealing the data.

Experts from Volexity have published an in-depth report on a piece of malware called DeepData. This malware was used by a Chinese threat actor known as BrazenBamboo to steal login credentials, and VPN server information from Fortinet VPNs.

As the experts explain, after a user logs into the VPN, user credentials remain in process memory. DeepData can find and decrypt JSON objects in the clients process memory, effectively stealing the information. As a final
step, DeepData can exfiltrate the information to a server under the attackers control. BrazenBamboo

Volexity found the vulnerability in early July 2024, and reported it to Fortinet. The company acknowledged the issue on July 24, however, it never acted on the findings, and the vulnerability is still unresolved. It was not even assigned a CVE number, and there is no indication when a fix might be available, if ever.

The findings are disturbing since Fortinets VPNs are used by many organizations of all sizes, all across the world. By obtaining login credentials, cybercriminals can gain access to company networks, which allows them to move laterally, steal more information, and potentially even deploy ransomware .

Until a patch is made available, Volexity advises users to restrict VPN access, and keep both eyes peeled for unusual login activity.

BrazenBamboo seems to be a state-sponsored threat actor, meaning its on
Chinas payroll. The researchers believe the group was the one to develop
three known malware families, Lightspy, DeepData, and DeepPost. Unlike North Korean groups, who dont shy away from deploying ransomware or other destructive malware, Chinese groups are mostly interested in cyber-espionage, and as such are usually trying their best to remain hidden for as long as possible.

Via BleepingComputer You might also like Chinese threat actors may have already breached UK critical infrastructure, ministers told Here's a list of the best firewalls today These are the best endpoint protection tools right now



======================================================================
Link to news story: https://www.techradar.com/pro/security/update-now-fortinet-windows-vpn-hacked- to-steal-user-data


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)