US, UK, and Australia warn of Iranian hacking activity after Microsoft report
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-13379 | Unauthenticated Path Traversal in Fortinet FortiOS SSL VPN CVE-2018-13379 is a path traversal flaw (CWE-22) in the Fortinet FortiOS SSL VPN web portal that allows an unauthenticated attacker to download FortiOS system files via specially crafted HTTP resource requests. By traversing directories through crafted requests to the exposed web portal, the attacker can retrieve sensitive files, a technique publicly documented as yielding the SSL VPN session file containing usernames and passwords in plaintext. Any organization running the SSL VPN web portal on a FortiGate appliance is affected, and risk is highest where the portal is directly reachable from the internet. The flaw is confirmed in the wild: it was added to the CISA KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. No public PoC is listed in the provided data, but credential theft tied to this bug has been widely reused by threat actors. Do: Apply the patched FortiOS release per Fortinet's vendor advisory immediately, as this is a CISA KEV required action; if the fixed version is not known from this data, follow Fortinet's FG-IR-18-384 advisory for the correct upgrade path. Rotate SSL VPN credentials and review VPN access logs for path-traversal requests, since successful exploitation exposes plaintext session credentials, and restrict SSL VPN portal exposure to trusted sources where possible. | 9.8 | 100% | KEV ransomware |
| mass≈500,000 internet-exposed FortiOS SSL VPN portals (Fortinet cited ~480,000 affected devices) | |
| CVE-2019-5591 | Default-Configuration LDAP Impersonation in Fortinet FortiOS CVE-2019-5591 is a default-configuration flaw in Fortinet FortiOS (CWE-306, missing authentication for a critical function): when a FortiGate acts as an LDAP client over SSL/TLS for authentication purposes, the default configuration does not properly authenticate the LDAP server, allowing an unauthenticated attacker on the same subnet to impersonate the LDAP server. The attack requires adjacency (the attacker must be on the same network segment as the device's LDAP traffic) and only works where the device uses LDAP over TLS with the default, non-validating settings. A successful attacker can intercept sensitive authentication information, such as usernames and passwords, exchanged with the LDAP server, with high confidentiality impact but no integrity or availability impact per the CVSS score. Organizations running affected FortiOS releases with LDAP-over-TLS configured are exposed; FortiOS runs on one of the largest firewall/VPN installed bases, though the source data does not state exact affected version ranges or deployment counts. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known in-the-wild and ransomware use; late-2021 CISA and FBI advisories warned that APT actors were exploiting Fortinet bugs, including this one, for initial access, and no public PoC is known. Do: Upgrade affected FortiGate/FortiOS units to a fixed release (6.2.1+, 6.0.8+, 5.6.10+, or 5.4.12+) per Fortinet's instructions, as required by CISA's KEV listing. If patching is delayed, disable the use of SSL/TLS in the LDAP server configuration or restrict and monitor the network path between the FortiGate and the LDAP server. Inventory which devices use LDAPS for authentication and review authentication logs for signs of server impersonation or credential theft. | 6.5 | 18% | KEV ransomware |
| largetens of thousands of FortiGate deployments plausibly affected (a subset of a very large FortiOS installed base that connects to LDAP over TLS) | |
| CVE-2020-12812 | MFA Bypass via Username Case Change in Fortinet FortiOS SSL VPN Fortinet FortiOS SSL VPN improperly validates the second factor of authentication (FortiToken), allowing a user with valid primary credentials to log in without being prompted for their one-time token. The bypass is triggered by changing the letter case of the username (e.g., typing 'Admin' instead of 'admin'), a case-sensitivity handling flaw (CWE-178) in the authentication logic (CWE-287). An attacker who has stolen, phished, or reused a user's primary credentials can therefore gain full SSL VPN access without the multi-factor protection defenders assume is enforced. Any organization running an affected FortiOS SSL VPN portal with FortiToken two-factor authentication for users is exposed. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and EPSS assigns a 49.3% probability of exploitation within 30 days (99th percentile); no public PoC is known. Do: Apply the FortiOS update per Fortinet's advisory, as required by CISA's KEV listing. Until patched, audit SSL VPN logs for successful logins in which no FortiToken second-factor prompt occurred (especially sessions authenticating with altered username case), and consider restricting the SSL VPN portal to trusted source addresses or disabling it temporarily. Any accounts found with second-factor-free VPN logins should have credentials rotated and be checked for follow-on compromise, given known ransomware use. | 9.8 | 49% | KEV ransomware |
| masson the order of hundreds of thousands of internet-exposed FortiOS SSL VPN portals (public scans in 2020-2021 counted roughly 150,000-500,000) | |
| CVE-2021-34473 | SSRF (CWE-918) in Microsoft Exchange Server Enabling RCE (ProxyShell) Microsoft Exchange Server contains a server-side request forgery (SSRF, CWE-918) in the Autodiscover service that unauthenticated remote attackers can reach over HTTP. This flaw is the first stage of the widely documented 'ProxyShell' chain, in which the SSRF is combined with privilege escalation and an arbitrary file write in the Exchange PowerShell backend to achieve unauthenticated remote code execution on the server. An attacker who successfully exploits it gains the ability to run code on the Exchange server, and ransomware operators (e.g., Cuba ransomware) leveraged this chain to deploy payloads. Organizations running on-premises Microsoft Exchange Server (2013, 2016, and 2019 per the vendor's advisories) are affected; hosted Exchange Online is a separately managed cloud service. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days (100th percentile). Do: Apply Microsoft's July 2021 (or later) Exchange Server security updates, which include the ProxyShell fixes, to all on-premises servers. If patching is delayed, restrict internet access to the Autodiscover/EWS frontend endpoints and consider the URL Rewrite mitigation Microsoft published for ProxyShell. Given the KEV listing and known ransomware use, treat internet-facing, unpatched Exchange servers as potentially compromised and hunt for webshells, unusual Exchange processes, and suspicious account or mailbox activity. | 9.1 | 100% | KEV ransomware PoC |
| masshundreds of thousands of on-prem Exchange servers; public internet scans at the time of disclosure showed roughly 400,000+ internet-exposed Exchange instances,… |
Full article697 words · extracted from therecord.media · click to collapse
Cybersecurity agencies from the US, UK, and Australia have published a joint security alert to raise awareness of an ongoing wave of intrusions carried out by Iranian government-sponsored hacking groups since the start of the year. The joint advisory, authored by the FBI, CISA, ACSC, and NCSC, comes a day after Microsoft has published its own report on the matter, detailing a rise in the sophistication and number of attacks carried out by Iranian groups. The joint advisory includes details about attacks during which Iranian hackers targeted Fortinet and Microsoft Exchange servers as a way to breach corporate networks. The four agencies provided examples of past attacks where Iranian groups used these two technologies as a point of entry: The joint advisory, available on the CISA and ACSC sites, also includes details about the techniques and tools that the Iranian hackers used after compromising Fortinet and Exchange servers, tools they used to move across a network. Similar to Microsoft's report yesterday, the joint advisory also mentions that in some instances, the Iranian groups also deployed ransomware inside some of the hacked networks. Multiple strains were used, including some that were developed in-house. But the Microsoft report is more expansive than the joint FBI, CISA, NCSC, and ACSC alerts and focuses on explaining how six Iranian groups had evolved in recent years to become highly-sophisticated threats that can vary their techniques and possess a wide malware arsenal. This includes the use of desktop and mobile malware, disk wipers, ransomware, sophisticated phishing techniques, brute-force and password-spraying attacks, some of the most sophisticated social engineering tricks today, and network exploitation. Microsoft said that one of the biggest differences from previous years was that Iranian groups now exhibit more patience in their intrusions, some of which can take weeks until they reach their goal. Furthermore, in some incidents, the cyberattacks supported physical operations, while in others, they supported espionage or information operations. This shows that the Iranian regime is learning from other countries that their cyber units can be used for more than just intelligence collection and tracking dissidents. The Microsoft report, followed up by the joint US, UK, and Australia joint advisory, comes to show that while Iranian threat actors might not be as sophisticated as US, Israeli, Russian, or Chinese counterparts, they are slowly catching up.Joint advisory warns of Fortinet and Exchange exploitation
Iranian groups branching into ransomware
No previous article
No new articles
Catalin Cimpanu
is a cybersecurity reporter who previously worked at ZDNet and Bleeping Computer, where he became a well-known name in the industry for his constant scoops on new vulnerabilities, cyberattacks, and law enforcement actions against hackers.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/us-uk-and-australia-warn-of-iranian-hacking-activity-after-microsoft-report