What We Do
How We Do
Resources
Company
Partners
Get Started
Blog

Hackers Exploit Fortinet Devices to Spread Ransomware within Corporate Environments, Warns eSentire

BY eSentire Threat Response Unit (TRU)

January 5, 2023 | 10 MINS READ

Attacks/Breaches

Managed Detection and Response

Ransomware

Threat Intelligence

Threat Response Unit

Want to learn more on how to achieve Cyber Resilience?

TALK TO AN EXPERT

Summary

In mid and late November 2022, eSentire detected and shut down hackers attempting to infect two of its customers, a Canadian-based college and a global investment firm, with ransomware. eSentire’s security research team, the Threat Response Unit (TRU), traced the attack to vulnerable Fortinet Virtual Private Network (VPN) devices belonging to eSentire’s customers. The VPNs were being managed and monitored by third-party providers; thus, TRU had no direct visibility into the devices.

However, this did not keep eSentire from detecting and intercepting the ransomware deployment. Here are the details:

On October 10, 2022, Fortinet, which develops next-generation firewalls, VPNs, antivirus, and endpoint solutions, among other offerings, issued a public security advisory disclosing that there was a critical vulnerability (CVE-2022-40684) impacting several of their products. Fortinet described the security weakness as an authentication bypass vulnerability. If successfully exploited, an unauthenticated attacker could gain access to a vulnerable Fortinet device. Specifically, devices which are often integrated with organization-wide authentication protocols like Lightweight Directory Access Protocol (LDAP) and Active Directory (AD) – the “keys to the kingdom,” so to speak.

Fortinet also stated in their October 10 advisory that they had seen only one incident where the vulnerability was being actively exploited. However, this quiet period was short-lived. Three days later, on October 13, 2022, a functional Proof-of-Concept (POC) exploit code was publicly released, and a flurry of activity on the hacker underground began.

TRU first saw a slew of threat actors scanning the internet for vulnerable Fortinet devices. Conducting Dark Web hunts, TRU then observed hackers buying and selling compromised Fortinet devices in the underground markets, indicating widespread exploitation – a typical outcome when technical details and knowledge of exploit code becomes public, and several threat actors begin engaging in exploitation. The exploitation operation appeared to include the exploitation of older vulnerabilities, such as CVE-2018-13374, as out-of-date Fortinet devices were not vulnerable to the 2022 vulnerability.

Hacker sales ranged from individual organizations (Figure 1) to bulk sales (Figure 2), with numerous buyers showing interest. One Initial Access Broker was seen offering monthly subscriptions to compromised Fortinet devices, located in specific countries, and selling this access in bulk at costs between $5,000 and $7,000; however, the currency was not provided in the initial ad (Figure 2).

Figure 1: An Initial Access Broker appearing to sell access to compromised Fortinet devices.

Figure 2: An Initial Access Broker sells bulk access to compromised Fortinet devices, not allowing individual sales.

Hunting for compromised Fortinet devices

Responding to this threat activity, eSentire’s TRU immediately tracked down the technical details of the exploit and created log-based detections for Fortinet devices. These detections were deployed across eSentire’s entire customer base, helping eSentire’s Security Operations Center (SOC) spot any attack activity related to the Fortinet vulnerability.

Conducting threat hunts, TRU swept historical logs from the Fortinet devices looking for indicators of compromise. TRU identified several customers whose devices showed signs of recent threat activity. In one case, the Initial Access Broker appeared to have tested his access using a benign payload, Microsoft’s Calculator application.

No further activity was observed, indicating that the compromised device was likely still being held by the Initial Access Broker who was trying to sell it and other devices he had under his control. For the two clients that opted not to collect Fortinet logs, attempted ransomware intrusions were later observed.

Ransomware hackers use hijacked Fortinet VPNs to gain initial access to a college and a global investment firm

In November 2022, TRU intercepted and shut down two separate cyber intrusions stemming from vulnerable Fortinet devices managed by third-party providers. It’s not clear whether the ransomware actors bought access through an Initial Access Broker or conducted the attacks themselves. The two targets included a college in Canada and a global investment firm.

In both cases, once the hackers got a foothold into the targets’ IT environments via the Fortinet VPNs, the threat actors used Microsoft’s Remote Desktop Protocol (RDP) service by abusing trusted Windows processes (also referred to as LOLBINs or living-off-the-land binaries) to achieve lateral movement. The hackers also abused the legitimate encryption utilities, BestCrypt and BitLocker, which were originally intended to secure data – not hold it hostage.

The ransomware operators presented a ransom note, but they did not reference a name and shame page on the dark web.

Taken together, the use of a remote exploit, the use of LOLBINs, and the use of legitimate encryption, and no leak site makes attribution more difficult. However, the ransom note did follow the format of a ransomware observed in early 2022 known as KalajaTomorr, an operation which has been observed deploying BestCrypt via RDP lateral movement.

Further, the email addresses provided in the ransom notes, from former incidents involving the KalajaTomorr ransomware, share a similar structure and similarly named anonymous email services:

[email protected]

[email protected]

TRU is tracking the campaign against the college and global investment firm as NahumVornkov.

The illicit business of Initial Access Brokers

A flood of initial access offerings for a particular hardware or software product on Dark Web marketplaces is indicative of a high value target. In the case of Fortinet, many of the sales were labeled “New Forti.” As mentioned previously, brokers offered buyers access to individual companies, which appeared to sell relatively quickly, as well as bulk sales that took longer for the brokers to move.

For access to individual organizations, details are provided about the organization such as industry, revenue, and security defenses. For bulk sales, however, these details are obscured. The disadvantage to threat actors when they attempt to make bulk sales is the sales tend to be slower, leading to longer dwell times on the compromised devices as they wait for a buyer who can afford the risk and cost of the purchase.

“SSL VPNs, such as the Fortinet VPNs are easy to misconfigure, and they are highly targeted for exploitation since they a) must be exposed to the internet and b) they provide access to credentials for the organization,” said Keegan Keplinger, Research and Reporting Lead for eSentire’s TRU.

“Additionally, the tendency for these devices to be managed by a third-party often means that the organization and their security providers have no direct visibility into activities being conducted on the device. This allows threat actors longer dwell times, as observed in the sale of these devices on the dark web. This makes SSL VPNs a prime target for Initial Access Brokers.”

Fortinet suffers a second vulnerability and threat actors clamor to exploit it

On December 9, 2022, a French security company disclosed a Remote Code Execution (RCE) vulnerability for Fortinet SSL VPNs. This weakness can enable a threat actor to remotely execute any type of code on the device.

On December 12, 2022, Fortinet acknowledged the vulnerability had been exploited. It’s unclear how far the RCE vulnerability goes back or whether current Fortinet access sales relate to the RCE vulnerability disclosed on December 9, 2022, or the Authentication Bypass Vulnerability disclosed in October 2022.

Breakdown of Events

As detailed in this report, cybercriminals took no time in exploiting the critical vulnerabilities discovered in the Fortinet products. This threat activity should serve as a stark reminder that threat actors are constantly looking for opportunities to compromise and infect organizations with everything from ransomware to credential stealers to crypto miners, and more.

Entities must remain diligent and proactively protect their critical data and applications from cyberthreats. eSentire's TRU provides the following recommendations.

Steps to secure critical IT devices from exploitation and how to protect organizations from ransomware breaches

If you’re not currently engaged with a Managed Detection and Response provider, we highly recommend you partner with us for security services in order to disrupt threats before they impact your business. Want to learn more? Connect with an eSentire Security Specialist.

eSentire Unit
eSentire Threat Response Unit (TRU)

The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.

Read the Latest from eSentire