FortiGate Fiasco: Hackers Hold On with Symbolic Links – Time to Patch Up!
Fortinet warns of a sneaky post-exploitation technique by threat actors using symbolic links to maintain read-only access to compromised FortiGate VPN devices. Even after patching, the virtual cat burglars remain. Fortinet urges immediate updates and vigilance to boot these digital squatters. FortiGate VPN devices need a watchful eye!
Hot Take:
**_Ah, Fortinet, where the plot thickens and the cybercriminals linger like a bad hangover—even after you thought you patched them out! It seems the bad guys have mastered the “Sorry, not sorry” technique by leaving behind symbolic breadcrumbs to access your precious FortiGate VPN devices. Who knew hacking could have its own form of arts and crafts?_**
Key Points:
– Fortinet warns against a post-exploitation technique used to maintain read-only access on compromised FortiGate VPN devices.
– Emails alerting customers were marked “Urgent action required” with a TLP:AMBER+STRICT designation.
– This issue arises from previous vulnerabilities (CVE-2022-42475, CVE-2023-27997, CVE-2024-21762).
– Attacks have been ongoing since early 2023, affecting numerous devices in France.
– Fortinet advises immediate software upgrades and configuration reviews to mitigate the risk.