FBI: Play ransomware gang has attacked 300 orgs since 2022
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-13379 | Unauthenticated Path Traversal in Fortinet FortiOS SSL VPN CVE-2018-13379 is a path traversal flaw (CWE-22) in the Fortinet FortiOS SSL VPN web portal that allows an unauthenticated attacker to download FortiOS system files via specially crafted HTTP resource requests. By traversing directories through crafted requests to the exposed web portal, the attacker can retrieve sensitive files, a technique publicly documented as yielding the SSL VPN session file containing usernames and passwords in plaintext. Any organization running the SSL VPN web portal on a FortiGate appliance is affected, and risk is highest where the portal is directly reachable from the internet. The flaw is confirmed in the wild: it was added to the CISA KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. No public PoC is listed in the provided data, but credential theft tied to this bug has been widely reused by threat actors. Do: Apply the patched FortiOS release per Fortinet's vendor advisory immediately, as this is a CISA KEV required action; if the fixed version is not known from this data, follow Fortinet's FG-IR-18-384 advisory for the correct upgrade path. Rotate SSL VPN credentials and review VPN access logs for path-traversal requests, since successful exploitation exposes plaintext session credentials, and restrict SSL VPN portal exposure to trusted sources where possible. | 9.8 | 100% | KEV ransomware |
| mass≈500,000 internet-exposed FortiOS SSL VPN portals (Fortinet cited ~480,000 affected devices) | |
| CVE-2020-12812 | MFA Bypass via Username Case Change in Fortinet FortiOS SSL VPN Fortinet FortiOS SSL VPN improperly validates the second factor of authentication (FortiToken), allowing a user with valid primary credentials to log in without being prompted for their one-time token. The bypass is triggered by changing the letter case of the username (e.g., typing 'Admin' instead of 'admin'), a case-sensitivity handling flaw (CWE-178) in the authentication logic (CWE-287). An attacker who has stolen, phished, or reused a user's primary credentials can therefore gain full SSL VPN access without the multi-factor protection defenders assume is enforced. Any organization running an affected FortiOS SSL VPN portal with FortiToken two-factor authentication for users is exposed. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and EPSS assigns a 49.3% probability of exploitation within 30 days (99th percentile); no public PoC is known. Do: Apply the FortiOS update per Fortinet's advisory, as required by CISA's KEV listing. Until patched, audit SSL VPN logs for successful logins in which no FortiToken second-factor prompt occurred (especially sessions authenticating with altered username case), and consider restricting the SSL VPN portal to trusted source addresses or disabling it temporarily. Any accounts found with second-factor-free VPN logins should have credentials rotated and be checked for follow-on compromise, given known ransomware use. | 9.8 | 49% | KEV ransomware |
| masson the order of hundreds of thousands of internet-exposed FortiOS SSL VPN portals (public scans in 2020-2021 counted roughly 150,000-500,000) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | gmx.de | ct the Play ransomware group at an email address ending in @gmx[.]de,” they said. “Ransom payments are paid in cryptocurrency |
Full article557 words · extracted from therecord.media · click to collapse
The ransomware gang behind several devastating attacks on major American cities has allegedly launched more than 300 successful incidents since June 2022, according to cybersecurity officials in the United States and Australia. The FBI joined the Cybersecurity and Infrastructure Security Agency (CISA) and the Australian Cyber Security Centre in publishing an advisory about the Play ransomware gang on Monday. This year alone, the group left cities like Oakland and Lowell, Massachusetts, as well as Dallas County, scrambling for days to deal with encrypted devices and troves of stolen citizen data. The government of Switzerland also warned in June that the group had stolen data during an attack on one of its IT providers. The agencies said the ransomware gang has attacked “a wide range of businesses and critical infrastructure in North America, South America, and Europe” over the last year-and-a-half. The FBI was aware of about 300 “affected entities,” as of October. In Australia, the first incident involving the group was observed in April, with the most recent in November. According to the notice, the group operates with more discretion than some of its competitors. In most cases, the gang does not include its demands in the ransom note, instead asking victims to contact them through email. “The Play ransomware group is presumed to be a closed group, designed to ‘guarantee the secrecy of deals,’ according to a statement on the group’s data leak website,” the agencies said. “Play ransomware actors employ a double-extortion model, encrypting systems after exfiltrating data.” The gang typically exploits stolen account credentials and public-facing applications — targeting vulnerabilities in popular products like the FortiOS vulnerabilities CVE-2018-13379 and CVE-2020-12812, as well as ProxyNotShell vulnerabilities in Microsoft tools. The hackers use a variety of tools to steal information and to scan for and disable anti-virus software. The gang typically adds the .play extension to filenames after splitting compromised data into smaller portions and exfiltrating it to hacker-controlled accounts. “The Play ransomware group uses a double-extortion model, encrypting systems after exfiltrating data. The ransom note directs victims to contact the Play ransomware group at an email address ending in @gmx[.]de,” they said. “Ransom payments are paid in cryptocurrency to wallet addresses provided by Play actors. If a victim refuses to pay the ransom demand, the ransomware actors threaten to publish exfiltrated data to their leak site on the Tor network ([.]onion URL).” When the Play group first emerged in mid-2022, it targeted government entities in Latin America, according to Trend Micro. More recently it drew headlines for a damaging attack on the city of Oakland, which spent weeks recovering from the incident, as well as others involving Stanley Steemer and the organization that runs the transit system for central Virginia. In April, the gang published 600 gigabytes of Oakland government data after releasing an initial batch of 10GB in March. The leaks included troves of sensitive data stolen from the city’s police department, driver’s license numbers, Social Security numbers and even information on the city’s elected officials.
No previous article
No new articles
Jonathan Greig
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/play-ransomware-targets-hundreds