<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello,
<div><br>
</div>
<div>I hope everyone is doing well!</div>
<div><br>
</div>
<div>Below is the entry for today.</div>
<div><br>
</div>
<div>09/09/2021 - Diary entry #344:</div>
<div><br>
</div>
<blockquote style="margin-top:0;margin-bottom:0">
<div>
<p>A threat actor named "Orange", administrator of the RAMP hacking forum and a previous operator of the Babuk Ransomware operation, has posted on the RAMP forum a link to a file containing thousands of Fortinet VPN accounts. At the same time, another post
appeared on Groove ransomware's wall-of-shame site, also promoting the leak which contains VPN credentials for 498,908 users over 12,856 devices. According to Bleeping, Orange is believed to be also a representative of the Groove ransomware operation. This
can be a partnership between RAMP and other groups, as we have seen in the Payload Bin forum.</p>
<p><br>
</p>
<p>The credentials were obtained from unpatched systems, using a path traversal vulnerability, tracked as CVE-2018-13379, in the FortiOS SSL VPN web portal. This vulnerability allows unauthenticated attackers to read arbitrary files, like the session file,
which contains plaintext credentials. This vulnerability was exploited by multiple threat actors since the date it was disclosed.</p>
<p><br>
</p>
<p>This kind of security incident is very dangerous, especially considering the credentials for VPNs used in organizations. The leaked credentials can be used as an entry vector for more complex attacks. For instance, the recent Colonial Pipelines attack, orchestrated
by the DarkSide group, used a compromised credential for a legacy VPN appliance. As this didn't implement multi-factor authentication or any additional security measures to allow access to the company systems, the attackers easily used it to deploy their ransomware
operation.</p>
<p><br>
</p>
<p>It's important for companies using Fortigate VPN to immediately invalidate all credentials if they believe it's possible they were affected by this incident, keep the VPN appliances up-to-date, and implement Multi-Factor Authentication as soon as possible.
Adopting a ZeroTrust methodology is also a must, as this can limit the damage of any potential breach and help companies to quickly recover after an incident. We also recommend switching from legacy VPN appliances to a Software-Defined Perimeter, allowing
them to authenticate the user and the device before allowing a connection, strengthening the security.</p>
</div>
</blockquote>
<div><br>
</div>
Kind Regards,<br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="font-size:medium; font-family:"Times New Roman"">
<tbody>
<tr>
<td style="width:180px" align="left">
<table width="120" align="left">
<tbody>
<tr>
<td colspan="3" align="center"><a href="https://www.appgate.com/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="120" height="30" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png"></a></td>
</tr>
<tr>
<td colspan="3" align="center"> </td>
</tr>
<tr>
<td width="37%" align="center"><a href="https://www.linkedin.com/company/appgate-security/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="18" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png"></a></td>
<td width="28%"><a href="https://twitter.com/AppgateSecurity" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="20" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png"></a></td>
<td width="35%"><a href="https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="26" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png"></a></td>
</tr>
</tbody>
</table>
<p style="margin-top:0px; margin-bottom:0px"> </p>
</td>
<td colspan="2" rowspan="2" style="width:350px">
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<strong>Felipe Tarijon de Almeida</strong><br>
Malware Analyst<br>
<strong>Appgate</strong></p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
E:<span style="margin:0px"> <a href="mailto:felipe.tarijon@appgate.com" title="mailto:felipe.tarijon@appgate.com">
felipe.tarijon@appgate.com</a></span><br>
O:<span> </span><span style="margin:0px; background-color:white">+55 11 97467 9549</span></p>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>