Gbhackers

https://gbhackers.com/

---

Category	Technology
Link Type	Do Follow
Max Links Allowed	2
Crypto, Gambling & Adult	Not accepted This publisher takes standard content only.
Google Indexed Pages	Check Indexed Pages
Sample Guest Post	https://gbhackers.com/hackers-attacking- ...

Full metrics Moz, Ahrefs and Semrush detail

	Rank: 5.2 Domain Authority: 57 Page Authority : 52 Links In: 66046 Equity: 20559
	Rank: 44862 Domain Rating: 74 External Backlinks: 254171 Referring Domains: 7419 Dofollow Backlinks: 190628 Referring IPs: 4822
	Rank: 353,870 Keywords: 16,071 Traffic: 4,619 Costs: 7,508 URL Links: 30,813 Host Links: 1,042,025 Domain Links: 1,042,185

Website Rating — not rated yet. A rating appears after the first orders.

---

A widespread campaign targeting Fortinet FortiGate firewall devices with exposed management interfaces on the public internet.

The attacks, observed by Arctic Wolf between November and December 2024, exploit what is believed to be a zero-day vulnerability, allowing unauthorized access and configuration changes to critical network security infrastructure.

The campaign, which affected devices running firmware versions 7.0.14 to 7.0.16, unfolded in four distinct phases:

1. Vulnerability Scanning (November 16-23, 2024)
2. Reconnaissance (November 22-27, 2024)
3. SSL VPN Configuration (December 4-7, 2024)
4. Lateral Movement (December 16-27, 2024)

During the initial phase, attackers conducted vulnerability scans, exploiting the jsconsole command-line interface. They often used unusual or spoofed IP addresses, including loopback addresses and public DNS resolvers, to mask their activities.

Reconnaissance Phases

The reconnaissance phase involved testing administrative privileges through initial configuration changes. Subsequently, in the SSL VPN configuration phase, attackers either created new super admin accounts or hijacked existing ones to infiltrate networks further.

 

Arctic Wolf’s lead threat intelligence researcher, Stefan Hostetler, noted, “The pattern of activity we observed was consistent with opportunistic widespread exploitation, given that each of the affected victim organizations had somewhere between hundreds to thousands of malicious login events on Fortinet firewall devices.”

While the exact vulnerability remains unconfirmed, security experts strongly suspect it to be a zero-day flaw.

The compressed timeline of attacks across multiple organizations and affected firmware versions supports this assessment.

The campaign’s impact has been significant, with at least tens of organizations affected across various industries.

Fortinet acknowledged the attacks in a security advisory, confirming that threat actors had exfiltrated sensitive data, including IP addresses, credentials, and configuration information of FortiGate devices managed by compromised FortiManager appliances.

In response to this threat, cybersecurity experts are urging organizations to take immediate action:

1. Disable public management interface access for FortiGate firewalls.
2. Update firmware to the latest stable versions.
3. Implement multi-factor authentication for administrative access.
4. Monitor for anomalous login behaviors and unauthorized configuration changes.
5. Conduct thorough threat hunting to detect potential compromises.

Fortinet has integrated detections for this campaign into its Managed Detection and Response (MDR) platform to enhance protection for customers. The company is actively investigating the issue and working on developing patches.

This incident underscores the critical importance of securing network management interfaces and limiting access to trusted internal users only.

As cyber threats continue to evolve, organizations must remain vigilant and proactive in their security measures to protect against potential vulnerabilities, especially those targeting critical network infrastructure components like firewalls.