| Category | Technology |
| Link Type | Do Follow |
| Max Links Allowed | 2 |
| Google Indexed Pages | Check Indexed Pages |
| Sample Guest Post |
https://gbhackers.com/hackers-attacking- ... |
|
Rank: 5.2 Domain Authority: 57 Page Authority : 52 Links In: 66046 Equity: 20559 |
|
Rank: 118517 Domain Rating: 69 External Backlinks: 160213 Referring Domains: 5574 Dofollow Backlinks: 101691 Referring IPs: 5292 |
|
Rank: 254308 Keywords: 17,560 Traffic: 6,611 Costs: 5,407 URL Links: 35,898 Host Links: 857,841 Domain Links: 858,022 |
Website Rating
N/A
No Data
No orders yet - rating will be calculated after first orders
--
Completion Rate
--
Avg Days
--
Reviews
No reviews available yet
|
|
A widespread campaign targeting Fortinet FortiGate firewall devices with exposed management interfaces on the public internet.
The attacks, observed by Arctic Wolf between November and December 2024, exploit what is believed to be a zero-day vulnerability, allowing unauthorized access and configuration changes to critical network security infrastructure.
The campaign, which affected devices running firmware versions 7.0.14 to 7.0.16, unfolded in four distinct phases:
During the initial phase, attackers conducted vulnerability scans, exploiting the jsconsole command-line interface. They often used unusual or spoofed IP addresses, including loopback addresses and public DNS resolvers, to mask their activities.
The reconnaissance phase involved testing administrative privileges through initial configuration changes. Subsequently, in the SSL VPN configuration phase, attackers either created new super admin accounts or hijacked existing ones to infiltrate networks further.
Arctic Wolf’s lead threat intelligence researcher, Stefan Hostetler, noted, “The pattern of activity we observed was consistent with opportunistic widespread exploitation, given that each of the affected victim organizations had somewhere between hundreds to thousands of malicious login events on Fortinet firewall devices.”
While the exact vulnerability remains unconfirmed, security experts strongly suspect it to be a zero-day flaw.
The compressed timeline of attacks across multiple organizations and affected firmware versions supports this assessment.
The campaign’s impact has been significant, with at least tens of organizations affected across various industries.
Fortinet acknowledged the attacks in a security advisory, confirming that threat actors had exfiltrated sensitive data, including IP addresses, credentials, and configuration information of FortiGate devices managed by compromised FortiManager appliances.
In response to this threat, cybersecurity experts are urging organizations to take immediate action:
Fortinet has integrated detections for this campaign into its Managed Detection and Response (MDR) platform to enhance protection for customers. The company is actively investigating the issue and working on developing patches.
This incident underscores the critical importance of securing network management interfaces and limiting access to trusted internal users only.
As cyber threats continue to evolve, organizations must remain vigilant and proactive in their security measures to protect against potential vulnerabilities, especially those targeting critical network infrastructure components like firewalls.
