Si tu gères un firewall #Fortigate (ou tu connais quelqu’un qui en administre un) avec SSL-VPN activé, prends 2 min pour vérifier s’il est compromis.

Depuis les attaques massives de 2024, des cybercriminels laissent des liens symboliques planqués dans les fichiers de langue. Résultat : même après patch, ils gardent accès au système.

Plus de 16 000 appareils compromis dans le monde, dont 208 en Suisse (source : Shadowserver).

Fortinet a publié un correctif + une signature AV/IPS pour nettoyer, mais faut mettre à jour.

https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity
[dans les news]
https://www.bleepingcomputer.com/news/security/over-16-000-fortinet-devices-compromised-with-symlink-backdoor/

https://dashboard.shadowserver.org/statistics/combined/tree/?day=2025-04-11&source=compromised_website&source=compromised_website6&tag=fortinet-compromised%2B&geo=all&data_set=count&scale=log

Et pour rappel : si vous administrez pour une entreprise, institution ou toute entité titulaire d’un AS ou de plages IP définies, vous pouvez recevoir des alertes directes de la fondation @shadowserver si un de vos équipements en frontière est détecté comme compromis.

Inscription ici : https://www.shadowserver.org/what-we-do/network-reporting/get-reports/

Hackers exploit Fortinet flaws to plant stealth backdoors on FortiGate devices, maintaining access even after patches.

Read: https://hackread.com/fortinet-fixe-attackers-bypass-patches-maintain-access/

#Fortinet: Hackers retain access to patched #FortiGate VPNs using symlinks

https://www.bleepingcomputer.com/news/security/fortinet-hackers-retain-access-to-patched-fortigate-vpns-using-symlinks/

#Symbolic #Link trick lets attackers bypass #FortiGate patches, #Fortinet warns
https://securityaffairs.com/176473/hacking/symbolic-link-trick-lets-attackers-bypass-fortigate-patches-fortinet-warns.html
#securityaffairs #hacking

Fortinet's VPN Security Breach: Hackers Exploit Symlinks for Persistent Access

Fortinet has issued urgent warnings to customers regarding a sophisticated attack method that allows hackers to retain access to compromised FortiGate VPN devices, even after vulnerabilities have been...

https://news.lavx.hu/article/fortinet-s-vpn-security-breach-hackers-exploit-symlinks-for-persistent-access

Fortinet's Symlink Vulnerability: A New Threat to FortiGate VPN Security

Fortinet has revealed a critical post-exploitation technique that allows threat actors to maintain access to compromised FortiGate VPN devices, even after patching vulnerabilities. This alarming disco...

https://news.lavx.hu/article/fortinet-s-symlink-vulnerability-a-new-threat-to-fortigate-vpn-security

There is a rumor about a new FortiGate vulnerability exploited in the wild from internet/external interfaces. FortiOS >=7.2.11 & >=7.4.7 is not affected.

Does anyone know something about that?

Friday at last.
Working with #fortigate wifi and #windows clients are tiresome and stressful sometimes..

But hey, i got #xfce4 .20 on my "new" #Freebsd
machine
#bhyve next

Good times

Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on #Fortinet #FortiGate Firewalls - Arctic Wolf

https://vulnerability.circl.lu/bundle/9a35bcae-d831-491f-945c-1fbd54769c38

CVE-2024-55591
CVE-2022-26118

Has anyone cracked password hashes from the recent #Fortigate dump and done any good analysis on them?

Asking Mastodon universe before I eventually start doing it myself.

FortiGate Firewall Breach: #BelsenGroup leaks over 15,000 configurations, exposing usernames, passwords, and network rules - Update credentials now!

Read: https://hackread.com/belsen-group-leaks-fortigate-firewall-configurations/

Forunderlig nok så er ikke #Russland og #Iran rammet av #fortigate lekkasjen #sikkerhet #Norsktut https://www.digi.no/artikler/analyse-se-angrepskart-15-000-hackede-brannmurer-ujevnt-fordelt/554847?sharing_key=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9%24eyJ1c2VySWQiOiI2MDIxMTIiLCJhcnRpY2xlSWQiOjU1NDg0NywiaWF0IjoxNzM3Mzg5NjczLCJleHAiOjE3Mzc0NzYwNzN9%24nIjk4S71RvR6eV_m--U1mggMlCJ992fIZSCB3cExhPc

Latest issue of my curated #cybersecurity and #infosec list of resources for week #03/2025 is out!

It includes the following and much more:

➝ Data of 15K of #FortiGate Devices Dumped

➝ Biden's New Cyber Executive Order

➝ PlugX #Malware Deleted from over 4,200 Infected Systems

➝ Governments Call For #Spyware Regulations

Subscribe to the #infosecMASHUP newsletter to have it piping hot in your inbox every week-end

https://infosec-mashup.santolaria.net/p/infosec-mashup-032025?r=299go8

Si vous cherchez à évaluer un éventuel impact du leak des configurations #Fortigate de 2022
( https://doublepulsar.com/2022-zero-day-was-used-to-raid-fortigate-firewall-configs-somebody-just-released-them-a7a74e0b0c7f ),
les IP des instances FortiGate compromises à l'époque, ont été mis à disposition ici

https://github.com/arsolutioner/fortigate-belsen-leak/blob/main/affected_ips.txt

Un script pour organiser les adresse par AS et pays est disponible ici

https://github.com/cudeso/tools/tree/master/CVE-2022-40684

...et pour les amateurs d'oignons, quelqu'un a fait ça

https://any.run/report/8706c4029bec49e5ce81a41956a85c14b4a3855a791ee74b78699e7fb796c6a6/5427006e-3537-4142-99f3-2b25a594a51b

Is your SOC, manager, or CTI team asking for the FortiGate IPS? This wonderful person uploaded them. https://github.com/arsolutioner/fortigate-belsen-leak/blob/main/affected_ips.txt

Remember kids. CTI is a team sport and we're all on the same team. Sharing is caring. #CTI #OSINT #FortiGate #Leak

@lawrenceabrams @GossiTheDog RE #FortiGate leak: I have found the version string "FWF61E-7.2.2-FW-build1327-220914" on one FortiWifi config from Colombia. I'm not sure which build date the first final version had but maybe a pre-release version?

Ich habe heute ein paar Stunden damit verbracht, mich durch 15.000 geleakte #FortiNet #FortiGate-Firewallconfigs zu wühlen und mit einigen Betroffenen gesprochen. Es ist unklar, wo die Daten herkamen, aber zumindest glaube ich jetzt einigermaßen genau zu wissen, wie alt sie sind.
Lest mehr hier: https://heise.de/-10244015

In addition to a critical CVE, a TA is offering a data set of purportedly 15,000 sets of {ip,config,password} for #FortiGate devices in the Darknet. The "Belsen Group" is a new TA (literally: 1 post on Breached) and their claim is unverified (for now). I have reached out to #Fortinet for comment.