Last week, Fortinet warned customers that they had discovered a new persistence mechanism used by a threat actor to retain read-only remote access to files in the root filesystem of previously compromised but now patched FortiGate devices. As the language files are publicly accessible on FortiGate devices with SSL-VPN enabled, the threat actor could browse to that folder and gain persistent read access to the root file system, even after the initial vulnerabilities were patched. Over 16,000 internet-exposed Fortinet devices have been detected as compromised with a new symlink backdoor that allows read-only access to sensitive files on previously compromised devices. Once they gained access to the devices, they created symbolic links in the language files folder to the root file system on devices with SSL-VPN enabled. This month, Fortinet began notifying customers privately by email about FortiGate devices detected by FortiGuard as being compromised with this symlink backdoor. Fortinet said that this was not through the exploitation of new vulnerabilities but is instead linked to attacks starting in 2023 and continuing into 2024, where a threat actor utilized zero days to compromise FortiOS devices. Fortinet has released an updated AV/IPS signature that will detect and remove this malicious symbolic link from compromised devices. "A threat actor used a known vulnerability to implement read-only access to vulnerable FortiGate devices.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 16 Apr 2025 20:52:18 +0000