Fortinet VPN Zero-Day Exploited in Malware Attacks Remains Unpatched: Report

Fortinet VPN Zero-Day Exploited in Malware Attacks Remains Unpatched: Report

November 18, 2024 at 07:19AM

DeepData malware, developed by the China-linked APT41 (BrazenBamboo), exploits a zero-day vulnerability in Fortinet’s Windows VPN to steal credentials. It uses plugins for data surveillance and has similarities with the LightSpy malware. Volexity reports its capabilities and infrastructure, revealing significant operational resources behind these attacks.

**Meeting Takeaways:**

1. **DeepData Malware Overview**:
– DeepData is a sophisticated surveillance malware framework that utilizes plugins to target sensitive information from browsers, communication apps, and password managers, and can also record audio via the system microphone.

2. **Exploitation of Vulnerability**:
– Recently identified exploitation occurred through a zero-day vulnerability in Fortinet’s VPN client for Windows, used to extract usernames, passwords, and other sensitive information from the process memory, as reported by cybersecurity firm Volexity.

3. **Threat Actor Involvement**:
– The malware is linked to the China-based advanced persistent threat (APT) group APT41, associated with espionage against journalists, politicians, and activists in Southeast Asia.

4. **Vulnerability Status**:
– The vulnerability affecting the Fortinet VPN client was reported in July and lacks a CVE identifier; it remains unpatched as of now.

5. **BrazenBamboo Connection**:
– Volexity identified BrazenBamboo as the developer of both DeepData and LightSpy malware frameworks, noting significant similarities in their code and infrastructure.

6. **LightSpy Variants**:
– A new Windows variant of LightSpy has been detected, showing different architectural features compared to other documented variants, and it shares data collection abilities with the existing LightSpy capabilities.

7. **Infrastructure Insights**:
– Approximately 30 command-and-control servers have been identified for both DeepData and LightSpy, highlighting the well-resourced nature of BrazenBamboo and their extensive operational capabilities.

8. **Implications for Security**:
– The analysis indicates a need for heightened awareness and security measures against multi-platform threats posed by advanced state-sponsored actors like BrazenBamboo.

9. **Further Investigations**:
– Communication has been initiated with Fortinet for a statement regarding the identified vulnerability, with updates expected on their response.

10. **General Observations**:
– The breadth of capabilities demonstrated by BrazenBamboo points to a highly evolved malware development function, posing ongoing challenges for cybersecurity measures.

These takeaways reflect the critical issues discussed regarding current cybersecurity threats, particularly those posed by state-sponsored actors and the vulnerabilities within widely used software.

Full Article