Multiple nation-state actors are actively exploiting a critical authentication bypass vulnerability in Fortinet FortiOS SSL-VPN. The flaw allows unauthorized remote access and has been linked to sophisticated cyber espionage campaigns.
A critical authentication bypass vulnerability (CVE-2024-21762) in Fortinet FortiOS SSL-VPN is being actively exploited by multiple nation-state threat actors. The vulnerability affects FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, and 6.4.0 through 6.4.14, allowing attackers to gain unauthorized access to protected networks without valid credentials. Forensic analysis has revealed sophisticated exploitation attempts attributed to both Chinese and Russian state-sponsored APT groups, targeting government agencies, defense contractors, and critical infrastructure organizations. The attacks have been observed since early January 2024, with threat actors leveraging the vulnerability to establish persistent access and deploy custom malware payloads.
Fortinet disclosed a critical authentication bypass vulnerability (CVE-2024-21762) affecting FortiOS SSL-VPN implementations. The vulnerability stems from improper session validation in the SSL-VPN component, allowing attackers to bypass authentication mechanisms and gain unauthorized remote access to protected networks.
The flaw exists in the following FortiOS versions:
The vulnerability allows attackers to bypass SSL-VPN authentication by manipulating session tokens. Successful exploitation provides unauthorized access to internal networks and potential lateral movement capabilities. Nation-state actors have been observed:
The observed attack chain typically involves:
The vulnerability poses a severe risk to organizations using affected FortiOS versions. Successful exploitation can lead to:
Organizations should implement the following mitigations immediately:
Monitor for the following indicators:
Multiple malicious packages discovered in PyPI and npm repositories executing credential theft and crypto mining payloads. Supply chain attacks leverage typosquatting and dependency confusion techniques to compromise development environments.
A critical authentication bypass vulnerability in ConnectWise ScreenConnect (CVE-2024-1709) is being actively exploited in the wild. The flaw allows attackers to gain unauthorized administrative access and execute remote code on affected systems.
Critical authentication bypass and command injection vulnerabilities in Ivanti Connect Secure VPN are being actively exploited in the wild. Threat actors are deploying web shells and maintaining persistence in compromised environments.
Chinese state-sponsored threat actor Salt Typhoon (aka Bronze Silhouette) conducts persistent intrusion campaign against US telecommunications providers. The group employs sophisticated living-off-the-land techniques and custom malware to maintain long-term access to critical infrastructure.