Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Visibility and response across your entire Microsoft security ecosystem.
XDR with Machine Learning that eliminates noise, enables real-time detection and response, and automatically blocks threats.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert threat hunting, original research, and proactive threat intelligence.
TRU is foundational to our MDR service. No add-ons or additional costs required.
Stop ransomware attacks before they disrupt your business.
Detect and respond to zero-day exploits.
Protect against third-party and supply chain risk.
Adopt a risk-based approach to cybersecurity.
Protect your most sensitive data.
Meet cybersecurity regulatory compliance mandates.
Eliminate misconfigurations and policy violations.
Prevent business disruption by outsourcing MDR.
Meet insurability requirements with MDR.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and mediating threats to prevent lateral spread.
Enhance investigation and threat detection across multi-cloud or hybrid environments.
Remediate critical misconfigurations, security vulnerabilities and policy violations across cloud and containerized environments.
Detect malicious insider and identity-based behavior leveraging machine learning models.
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company's mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
We believe a multi-signal approach is paramount to protecting your complete attack surface. See why eSentire MDR means multi-signal telemetry and complete response.
See how our 24/7 SOC Cyber Analysts and Elite Threat Hunters stop even the most advanced cyberattacks before they disrupt your business.
Choose the right mix of Managed Detection and Response, Exposure Management, and Incident Response services to strengthen your cyber resilience.
Try our interactive tools including the MITRE ATT&CK Tool, the SOC Pricing Calculator, the Cybersecurity Maturity Assessment, and our MDR ROI Calculator.
Read the latest security advisories, blogs, reports, industry publications and webinars published by eSentire's Threat Response Unit (TRU).
See why 2000+ organizations count on eSentire to build resilience and prevent business disruption.
In mid and late November 2022, eSentire detected and shut down hackers attempting to infect two of its customers, a Canadian-based college and a global investment firm, with ransomware. eSentire’s security research team, the Threat Response Unit (TRU), traced the attack to vulnerable Fortinet Virtual Private Network (VPN) devices belonging to eSentire’s customers. The VPNs were being managed and monitored by third-party providers; thus, TRU had no direct visibility into the devices.
However, this did not keep eSentire from detecting and intercepting the ransomware deployment. Here are the details:
On October 10, 2022, Fortinet, which develops next-generation firewalls, VPNs, antivirus, and endpoint solutions, among other offerings, issued a public security advisory disclosing that there was a critical vulnerability (CVE-2022-40684) impacting several of their products. Fortinet described the security weakness as an authentication bypass vulnerability. If successfully exploited, an unauthenticated attacker could gain access to a vulnerable Fortinet device. Specifically, devices which are often integrated with organization-wide authentication protocols like Lightweight Directory Access Protocol (LDAP) and Active Directory (AD) – the “keys to the kingdom,” so to speak.
Fortinet also stated in their October 10 advisory that they had seen only one incident where the vulnerability was being actively exploited. However, this quiet period was short-lived. Three days later, on October 13, 2022, a functional Proof-of-Concept (POC) exploit code was publicly released, and a flurry of activity on the hacker underground began.
TRU first saw a slew of threat actors scanning the internet for vulnerable Fortinet devices. Conducting Dark Web hunts, TRU then observed hackers buying and selling compromised Fortinet devices in the underground markets, indicating widespread exploitation – a typical outcome when technical details and knowledge of exploit code becomes public, and several threat actors begin engaging in exploitation. The exploitation operation appeared to include the exploitation of older vulnerabilities, such as CVE-2018-13374, as out-of-date Fortinet devices were not vulnerable to the 2022 vulnerability.
Hacker sales ranged from individual organizations (Figure 1) to bulk sales (Figure 2), with numerous buyers showing interest. One Initial Access Broker was seen offering monthly subscriptions to compromised Fortinet devices, located in specific countries, and selling this access in bulk at costs between $5,000 and $7,000; however, the currency was not provided in the initial ad (Figure 2).
Figure 1: An Initial Access Broker appearing to sell access to compromised Fortinet devices.
Figure 2: An Initial Access Broker sells bulk access to compromised Fortinet devices, not allowing individual sales.
Responding to this threat activity, eSentire’s TRU immediately tracked down the technical details of the exploit and created log-based detections for Fortinet devices. These detections were deployed across eSentire’s entire customer base, helping eSentire’s Security Operations Center (SOC) spot any attack activity related to the Fortinet vulnerability.
Conducting threat hunts, TRU swept historical logs from the Fortinet devices looking for indicators of compromise. TRU identified several customers whose devices showed signs of recent threat activity. In one case, the Initial Access Broker appeared to have tested his access using a benign payload, Microsoft’s Calculator application.
No further activity was observed, indicating that the compromised device was likely still being held by the Initial Access Broker who was trying to sell it and other devices he had under his control. For the two clients that opted not to collect Fortinet logs, attempted ransomware intrusions were later observed.
In November 2022, TRU intercepted and shut down two separate cyber intrusions stemming from vulnerable Fortinet devices managed by third-party providers. It’s not clear whether the ransomware actors bought access through an Initial Access Broker or conducted the attacks themselves. The two targets included a college in Canada and a global investment firm.
In both cases, once the hackers got a foothold into the targets’ IT environments via the Fortinet VPNs, the threat actors used Microsoft’s Remote Desktop Protocol (RDP) service by abusing trusted Windows processes (also referred to as LOLBINs or living-off-the-land binaries) to achieve lateral movement. The hackers also abused the legitimate encryption utilities, BestCrypt and BitLocker, which were originally intended to secure data – not hold it hostage.
The ransomware operators presented a ransom note, but they did not reference a name and shame page on the dark web.
Taken together, the use of a remote exploit, the use of LOLBINs, and the use of legitimate encryption, and no leak site makes attribution more difficult. However, the ransom note did follow the format of a ransomware observed in early 2022 known as KalajaTomorr, an operation which has been observed deploying BestCrypt via RDP lateral movement.
Further, the email addresses provided in the ransom notes, from former incidents involving the KalajaTomorr ransomware, share a similar structure and similarly named anonymous email services:
TRU is tracking the campaign against the college and global investment firm as NahumVornkov.
A flood of initial access offerings for a particular hardware or software product on Dark Web marketplaces is indicative of a high value target. In the case of Fortinet, many of the sales were labeled “New Forti.” As mentioned previously, brokers offered buyers access to individual companies, which appeared to sell relatively quickly, as well as bulk sales that took longer for the brokers to move.
For access to individual organizations, details are provided about the organization such as industry, revenue, and security defenses. For bulk sales, however, these details are obscured. The disadvantage to threat actors when they attempt to make bulk sales is the sales tend to be slower, leading to longer dwell times on the compromised devices as they wait for a buyer who can afford the risk and cost of the purchase.
“SSL VPNs, such as the Fortinet VPNs are easy to misconfigure, and they are highly targeted for exploitation since they a) must be exposed to the internet and b) they provide access to credentials for the organization,” said Keegan Keplinger, Research and Reporting Lead for eSentire’s TRU.
“Additionally, the tendency for these devices to be managed by a third-party often means that the organization and their security providers have no direct visibility into activities being conducted on the device. This allows threat actors longer dwell times, as observed in the sale of these devices on the dark web. This makes SSL VPNs a prime target for Initial Access Brokers.”
On December 9, 2022, a French security company disclosed a Remote Code Execution (RCE) vulnerability for Fortinet SSL VPNs. This weakness can enable a threat actor to remotely execute any type of code on the device.
On December 12, 2022, Fortinet acknowledged the vulnerability had been exploited. It’s unclear how far the RCE vulnerability goes back or whether current Fortinet access sales relate to the RCE vulnerability disclosed on December 9, 2022, or the Authentication Bypass Vulnerability disclosed in October 2022.
As detailed in this report, cybercriminals took no time in exploiting the critical vulnerabilities discovered in the Fortinet products. This threat activity should serve as a stark reminder that threat actors are constantly looking for opportunities to compromise and infect organizations with everything from ransomware to credential stealers to crypto miners, and more.
Entities must remain diligent and proactively protect their critical data and applications from cyberthreats. eSentire's TRU provides the following recommendations.
If you’re not currently engaged with a Managed Detection and Response provider, we highly recommend you partner with us for security services in order to disrupt threats before they impact your business. Want to learn more? Connect with an eSentire Security Specialist.
The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.