Fortinet has revealed that threat actors have now found a way to leverage multiple patched FortiGate vulnerabilities to maintain read-only access to devices after exploiting initial access vectors to breach devices.
The attackers are believed to have exploited known patched vulnerabilities tracked as CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762.
CVE-2022-42475 (CVSS 9.8):
CVE-2023-27997:
CVE-2023-21762
“A threat actor used a known vulnerability to implement read-only access to vulnerable FortiGate devices,”, Fortinet stated in an advisory released regarding the exploits. Fortinet stated that this was achieved via the attacker creating a symbolic link between the user file system and root file system in a folder used to serve language files for the FortiGate VPN.
The modifications took place within the user file system and managed to evade detection, which caused the symlink to be left behind despite the security flaws being patched. This then allowed the threat actors to maintain read-only access to the targets devices file system, which included the system configuration files. It is important to note that users that have never enabled FortiGate SSL-VPN are not impacted by this.
Fortinet have stated that the investigation into this activity has not highlighted any specific industries or countries being targeted by the4se attacks. Fortinet has notified all affected customers, and advised all affected users to apply the latest product patches seen below:
References:
Fortinet Warns Attackers Retain FortiGate Access Post-Patching via SSL-VPN Symlink Exploit (thehackernews.com)
Analysis of Threat Actor Activity (fortinet.com)
CVE-2022-42475 (cvedetails.com)
CVE-2023-27997 (cvedetails.com)
CVE-2024-21762 (cvedetails.com)
Phishing threat actors are now employing a new evasion tactic labelled “Precision-Validated Phishing” that only shows fake login forms when a target user enters an email address that the threat actors are specifically targeting. What sets this new technique apart from the traditional en masse phishing campaigns, is that this new technique uses real-time email validation to show phishing content to only pre-verified targets.
While this technique may sound advanced, the reality is that this technique works simply by excluding all non-targets from the phishing process, essentially blocking their visibility into the phishing process.
The use of this technique also makes research into these attacks difficult. Usually, when investigating phishing campaigns, it is common for researchers to utilise fake email addresses to simulate what occurs during the phishing process. However, since this phishing technique only targets predetermined users, the use of fake emails will redirect researchers to benign sites or flag errors. This also affects the effectiveness of automated security crawlers and sandboxes, as these will have a harder time detecting phishing links utilising this technique.
Cofense, an email security firm, has documented the rise of this technique and has identified two main techniques utilised to achieve the real-time email validation. The first involves abusing third-party email verification services and integrating them into the phishing kit, as this checks the validity of the target’s email address in real-time using API calls. The second method deploys a custom JavaScript into the phishing page, which pings the attacker’s server with a list of email addresses provided by victims entering their details on the site, which then checks the emails with the pre-harvested list on the attacker server. If there is a match, the target user will be directed to the phishing site. If not, then the user will be redirected to a benign site.
It is reported that some campaigns have added even more steps to ensure that security researchers cannot replicate the steps of the attack by using a previously targeted email. Some of the campaigns observed utilise a pseudo two-step verification for their phishing, where the user will receive a code in their inbox, which they then input back into the site to confirm.
With the implementation of dynamic input validation, it is becoming harder and harder to detect phishing attacks. The Human Risk Management module from Norm can educate users on how to spot a likely malicious link. With this education, not only would users be more aware of the tactics used by attackers but also the content will enable them to exercise caution when clicking on suspicious links. It is also recommended to take a minute to assess a link before clicking and never give any remote access to your device.
References:
Phishing kits now vet victims in real-time before stealing credentials (bleepingcomputer.com)
Precision-Validated Phishing: A New Threat to Defenders (cofense.com)
Oracle has finally confirmed a significant data breach that saw the theft of legacy client login credentials that first came to light in March 2025. After previously denying the compromise, Oracle is now reportedly informing select customers of the intrusion that impacted outdated systems, which reportedly included data dated as recently as 2024.
In March 2025, a user under the alias of “rose87168” made a post on BreachForums, stating that they were selling 6 million Oracle customer records, which they had obtained via a breach to Oracle systems. Oracle insisted that there was no data compromise and dismissed any claims of such, reassuring customers that Oracle Cloud systems remained uncompromised. However, multiple cyber security firms have since validated the authenticity of the leaked data, which included usernames, encrypted SSO and LDAP credentials, Java Keystore files and JPS keys.
According to those briefed during Oracle’s internal investigation, the attack had targeted a legacy environment which was not used in active services and was decommissioned eight years ago. However, this was also put into question after a source familiar to the breach indicated that some of the stolen data was dated as recently as 2024. This then raised more questions to Oracle regarding their handling of the legacy data retention and the internal system segmentation.
The attack appears to have originated from exploiting a vulnerability within Oracle’s Gen 1 cloud infrastructure, which was followed shortly by a webshell and malware deployment into Oracle’s Identity Management (IDM) database, which allowed the attacker to exfiltrate sensitive authentication data. It was reported that the breach likely began back in January 2025 via the exploitation of a Java vulnerability within the Oracle infrastructure, and that Oracle became aware of the suspicious activity some time in February, shortly before the first ransom in March.
The attacker appeared publicly on 5th March 2025 and has since demanded a ransom from Oracle of $20 Million. However, the threat actor also showed a willingness to barter for the stolen data, specifically looking for zero-day exploits which suggests that their motivations may have been more than just financial.
References:
Oracle Finally Admits to Data Breach, FBI Investigating (cyberinsider.com)
Oracle (ORCL) Tells Clients of Second Recent Hack, Log-in Data Stolen (bloomberg.com)
Oracle denies breach after hacker claims theft of 6 million data records (bleepingcomputer.com)
Norm tracks and monitors the latest security trends and cyber threats and collates these into a fortnightly threat bulletin.
You can receive this bulletin for free, every fortnight, by entering your business email address below:
