What We Do
How we do it
Resources
TRU INTELLIGENCE CENTER
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
View Threat Intelligence Resources →
SECURITY ADVISORIES
Jan 19, 2023
Increased Activity in Google Ads Distributing Information Stealers
THE THREAT On January 18th, 2023, eSentire Threat Intelligence identified multiple reports, both externally and internally, containing information on an ongoing increase in Google advertisements…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1500+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Dec 13, 2022
eSentire Named First Managed Detection and Response Partner by Global Insurance Provider Coalition
Waterloo, ON – December 13, 2022 – eSentire, Inc., the Authority in Managed Detection and Response (MDR), today announced it has been named the first global MDR partner by Coalition, the world’s first Active Insurance provider designed to prevent digital risk before it strikes. Like Coalition, eSentire is committed to putting their customers’ businesses ahead of disruption by improving their…
Read More
Partners
PARTNER PROGRAM
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
ECOSYSTEM PARTNER RESOURCES
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Blog — Jan 05, 2023

Hackers Exploit Fortinet Devices to Spread Ransomware within Corporate Environments, Warns eSentire

10 minutes read
Speak With A Security Expert Now

Summary

In mid and late November 2022, eSentire detected and shut down hackers attempting to infect two of its customers, a Canadian-based college and a global investment firm, with ransomware. eSentire’s security research team, the Threat Response Unit (TRU), traced the attack to vulnerable Fortinet Virtual Private Network (VPN) devices belonging to eSentire’s customers. The VPNs were being managed and monitored by third-party providers; thus, TRU had no direct visibility into the devices.

However, this did not keep eSentire from detecting and intercepting the ransomware deployment. Here are the details:

On October 10, 2022, Fortinet, which develops next-generation firewalls, VPNs, antivirus, and endpoint solutions, among other offerings, issued a public security advisory disclosing that there was a critical vulnerability (CVE-2022-40684) impacting several of their products. Fortinet described the security weakness as an authentication bypass vulnerability. If successfully exploited, an unauthenticated attacker could gain access to a vulnerable Fortinet device. Specifically, devices which are often integrated with organization-wide authentication protocols like Lightweight Directory Access Protocol (LDAP) and Active Directory (AD) – the “keys to the kingdom,” so to speak.

Fortinet also stated in their October 10 advisory that they had seen only one incident where the vulnerability was being actively exploited. However, this quiet period was short-lived. Three days later, on October 13, 2022, a functional Proof-of-Concept (POC) exploit code was publicly released, and a flurry of activity on the hacker underground began.

TRU first saw a slew of threat actors scanning the internet for vulnerable Fortinet devices. Conducting Dark Web hunts, TRU then observed hackers buying and selling compromised Fortinet devices in the underground markets, indicating widespread exploitation – a typical outcome when technical details and knowledge of exploit code becomes public, and several threat actors begin engaging in exploitation. The exploitation operation appeared to include the exploitation of older vulnerabilities, such as CVE-2018-13374, as out-of-date Fortinet devices were not vulnerable to the 2022 vulnerability.

Hacker sales ranged from individual organizations (Figure 1) to bulk sales (Figure 2), with numerous buyers showing interest. One Initial Access Broker was seen offering monthly subscriptions to compromised Fortinet devices, located in specific countries, and selling this access in bulk at costs between $5,000 and $7,000; however, the currency was not provided in the initial ad (Figure 2).

Figure 1: An Initial Access Broker appearing to sell access to compromised Fortinet devices.

Figure 2: An Initial Access Broker sells bulk access to compromised Fortinet devices, not allowing individual sales.

Hunting for compromised Fortinet devices

Responding to this threat activity, eSentire’s TRU immediately tracked down the technical details of the exploit and created log-based detections for Fortinet devices. These detections were deployed across eSentire’s entire customer base, helping eSentire’s Security Operations Center (SOC) spot any attack activity related to the Fortinet vulnerability.

Conducting threat hunts, TRU swept historical logs from the Fortinet devices looking for indicators of compromise. TRU identified several customers whose devices showed signs of recent threat activity. In one case, the Initial Access Broker appeared to have tested his access using a benign payload, Microsoft’s Calculator application.

No further activity was observed, indicating that the compromised device was likely still being held by the Initial Access Broker who was trying to sell it and other devices he had under his control. For the two clients that opted not to collect Fortinet logs, attempted ransomware intrusions were later observed.

Ransomware hackers use hijacked Fortinet VPNs to gain initial access to a college and a global investment firm

In November 2022, TRU intercepted and shut down two separate cyber intrusions stemming from vulnerable Fortinet devices managed by third-party providers. It’s not clear whether the ransomware actors bought access through an Initial Access Broker or conducted the attacks themselves. The two targets included a college in Canada and a global investment firm.

In both cases, once the hackers got a foothold into the targets’ IT environments via the Fortinet VPNs, the threat actors used Microsoft’s Remote Desktop Protocol (RDP) service by abusing trusted Windows processes (also referred to as LOLBINs or living-off-the-land binaries) to achieve lateral movement. The hackers also abused the legitimate encryption utilities, BestCrypt and BitLocker, which were originally intended to secure data – not hold it hostage.

The ransomware operators presented a ransom note, but they did not reference a name and shame page on the dark web.

Taken together, the use of a remote exploit, the use of LOLBINs, and the use of legitimate encryption, and no leak site makes attribution more difficult. However, the ransom note did follow the format of a ransomware observed in early 2022 known as KalajaTomorr, an operation which has been observed deploying BestCrypt via RDP lateral movement.

Further, the email addresses provided in the ransom notes, from former incidents involving the KalajaTomorr ransomware, share a similar structure and similarly named anonymous email services:

[email protected]

[email protected]

TRU is tracking the campaign against the college and global investment firm as NahumVornkov.

The illicit business of Initial Access Brokers

A flood of initial access offerings for a particular hardware or software product on Dark Web marketplaces is indicative of a high value target. In the case of Fortinet, many of the sales were labeled “New Forti.” As mentioned previously, brokers offered buyers access to individual companies, which appeared to sell relatively quickly, as well as bulk sales that took longer for the brokers to move.

For access to individual organizations, details are provided about the organization such as industry, revenue, and security defenses. For bulk sales, however, these details are obscured. The disadvantage to threat actors when they attempt to make bulk sales is the sales tend to be slower, leading to longer dwell times on the compromised devices as they wait for a buyer who can afford the risk and cost of the purchase.

“SSL VPNs, such as the Fortinet VPNs are easy to misconfigure, and they are highly targeted for exploitation since they a) must be exposed to the internet and b) they provide access to credentials for the organization,” said Keegan Keplinger, Research and Reporting Lead for eSentire’s TRU.

“Additionally, the tendency for these devices to be managed by a third-party often means that the organization and their security providers have no direct visibility into activities being conducted on the device. This allows threat actors longer dwell times, as observed in the sale of these devices on the dark web. This makes SSL VPNs a prime target for Initial Access Brokers.”

Fortinet suffers a second vulnerability and threat actors clamor to exploit it

On December 9, 2022, a French security company disclosed a Remote Code Execution (RCE) vulnerability for Fortinet SSL VPNs. This weakness can enable a threat actor to remotely execute any type of code on the device.

On December 12, 2022, Fortinet acknowledged the vulnerability had been exploited. It’s unclear how far the RCE vulnerability goes back or whether current Fortinet access sales relate to the RCE vulnerability disclosed on December 9, 2022, or the Authentication Bypass Vulnerability disclosed in October 2022.

Breakdown of Events

As detailed in this report, cybercriminals took no time in exploiting the critical vulnerabilities discovered in the Fortinet products. This threat activity should serve as a stark reminder that threat actors are constantly looking for opportunities to compromise and infect organizations with everything from ransomware to credential stealers to crypto miners, and more.

Entities must remain diligent and proactively protect their critical data and applications from cyberthreats. eSentire's TRU provides the following recommendations.

Steps to secure critical IT devices from exploitation and how to protect organizations from ransomware breaches

If you’re not currently engaged with a Managed Detection and Response provider, we highly recommend you partner with us for security services in order to disrupt threats before they impact your business. Want to learn more? Connect with an eSentire Security Specialist.

View Most Recent Blogs
eSentire Threat Response Unit (TRU)
eSentire Threat Response Unit (TRU)

Our industry-renowned Threat Response Unit (TRU) is an elite team of threat hunters and researchers, that supports our 24/7 Security Operations Centers (SOCs), builds detection models across our Atlas XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. TRU has been recognized for its threat hunting, original research and content development capabilities. TRU is strategically organized into cross-functional groups to protect you against advanced and emerging threats, allowing your organization to gain leading threat intelligence and incredible cybersecurity acumen.