FBI and CISA warn of state hackers attacking Fortinet FortiOS servers

The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) warn of advanced persistent threat (APT) actors targeting Fortinet FortiOS servers using multiple exploits.

In the Joint Cybersecurity Advisory (CSA) published today, the agencies warn admins and users that the state-sponsored hacking groups are “likely” exploiting Fortinet FortiOS vulnerabilities CVE-2018-13379, CVE-2020-12812, and CVE-2019-5591.

The attackers are enumerating servers unpatched against CVE-2020-12812 and CVE-2019-5591, and scanning for CVE-2018-13379 vulnerable devices on ports 4443, 8443, and 10443.

Compromised servers may be used in future attacks

The APT group may use abuse these security bugs in the future to breach the networks of government, commercial, and technology services. Once they gain infiltrate the targets’ networks, they might use this initial access for future attacks.

“The APT actors may be using any or all of these CVEs to gain access to networks across multiple critical infrastructure sectors to gain access to key networks as pre-positioning for follow-on data exfiltration or data encryption attacks,” the joint advisory reads [PDF].

“APT actors may use other CVEs or common exploitation techniques—such as spearphishing—to gain access to critical infrastructure networks to pre-position for follow-on attacks.”

“APT actors have historically exploited critical vulnerabilities to conduct distributed denial-of-service (DDoS) attacks, ransomware attacks, structured query language (SQL) injection attacks, spearphishing campaigns, website defacements, and disinformation campaigns.”

The FBI and CISA have also shared mitigation measures to block compromise attempts in these ongoing state-sponsored attacks.

Fortinet exploits used to hack US election support systems

In November 2020, a threat actor shared a list of one-line CVE-2018-13379 exploits that could be used to steal VPN credentials from almost 50,000 Fortinet VPN servers, including governments and banks.

State hackers also abused the CVE-2018-13379 vulnerability in the Fortinet FortiOS Secure Socket Layer (SSL) VPN to compromise U.S. election support systems reachable over the Internet.

In September 2020, Microsoft warned of Russian, Chinese, and Iranian APT actors targeting the 2020 US elections.

Microsoft’s report confirmed US govt intelligence shared last year on Russian, Iranian, and Chinese hackers trying to “compromise the private communications of U.S. political campaigns, candidates and other political targets.”

Earlier this year, Fortinet fixed multiple severe vulnerabilities impacting its products, including Remote Code Execution (RCE), SQL Injection, and Denial of Service (DoS) bugs affecting FortiProxy SSL VPN and FortiWeb Web Application Firewall (WAF) products.

Update: Fortinet sent the following statement after the article was published:

The security of our customers is our first priority. CVE-2018-13379 is an old vulnerability resolved in May 2019. Fortinet immediately issued a PSIRT advisory and communicated directly with customers and via corporate blog posts on multiple occasions in August 2019 and July 2020 strongly recommending an upgrade. Upon resolution, we have consistently communicated with customers, as recently as late as 2020. CVE-2019-5591 was resolved in July 2019 and CVE-2020-12812 was resolved in July 2020. To get more information, please visit our blog and immediately refer to the May 2019 advisory. If customers have not done so, we urge them to immediately implement the upgrade and mitigations.