Fortinet Says Recently Patched Vulnerability Exploited to Hack Governments

Fortinet reported this week that a recently patched vulnerability tracked as CVE-2022-42475 has been exploited in highly targeted attacks aimed at government organizations.

The security hole impacts the FortiOS SSL-VPN and it can allow a remote, unauthenticated hacker to execute arbitrary code or commands using specially crafted requests.

The vulnerability’s existence was disclosed on December 12, 2022, when Fortinet warned that it was aware of in-the-wild exploitation. The company at the time announced patches and shared indicators of compromise (IoCs).

In a blog post published this week, Fortinet’s Product Security Incident Response Team (PSIRT) shared additional details, including on the malware sample delivered in the observed attacks, as well as the related network traffic.

“The complexity of the exploit suggests an advanced actor and that it is highly targeted at governmental or government-related targets,” the cybersecurity firm said.

When the existence of CVE-2022-42475 came to light, researcher Kevin Beaumont said that it appeared to have been exploited by a ransomware group, but after additional information emerged, the expert said it may have actually been a state-sponsored threat actor disguising its activities as a ransomware operation.

According to new information shared by Fortinet, the hackers delivered a variant of a generic Linux malware customized for targeting its FortiOS operating system.

While some of the payloads could not be recovered, the company’s analysis indicated that the attackers were trying to execute commands, download additional malicious components to compromised systems, and manipulate FortiOS logging functionality.

Regarding the logs, the malware deployed in the attack attempted to patch the FortiOS logging process in an effort to alter logs and evade detection. The malware is also capable of killing the logging process.

This detailed analysis has allowed Fortinet to share additional IoCs.

It’s not uncommon for malicious actors to exploit vulnerabilities in Fortinet products in their attacks, and the vendor admitted in the past that some customers are slow when it comes to patching, even actively exploited vulnerabilities.

According to data from CISA’s Known Exploited Vulnerabilities Catalog, a total of nine Fortinet product vulnerabilities have been exploited in attacks since 2018.

Related: PoC Published for Fortinet Vulnerability as Mass Exploitation Attempts Begin

Related: Cybercriminals Selling Access to Networks Compromised via Recent Fortinet Vulnerability

Related: High-Severity Command Injection Flaws Found in Fortinet’s FortiTester, FortiADC