#MitigationStrategie

[govindhtech]

Mandiant Finds UNC5820 FortiManager For Data Exfiltration

Mandiant and Fortinet worked together in October 2024 to look into the widespread abuse of FortiManager appliances across more than fifty potentially compromised FortiManager devices in a range of businesses. A threat actor can use an unauthorized, threat actor-controlled FortiManager device to run arbitrary code or commands against susceptible FortiManager devices with the vulnerability, CVE-2024-47575 / FG-IR-24-423.

As early as June 27, 2024, Mandiant saw a new threat cluster that is currently monitor as UNC5820 taking advantage of the FortiManager vulnerability. The configuration information of the FortiGate devices controlled by the compromised FortiManager was staged and exfiltrated by UNC5820. Along with the users and their FortiOS256-hashed passwords, this data includes comprehensive configuration details for the controlled equipment. UNC5820 might utilize this information to target the enterprise environment, advance laterally to the controlled Fortinet devices, and further attack the FortiManager.

The precise requests that the threat actor made in order to take advantage of the FortiManager vulnerability were not yet documented in the data sources that Mandiant examined. Furthermore, as of this point in Google cloud study, there is no proof that UNC5820 used the configuration data it had acquired to migrate laterally and endanger the environment even more. It therefore don’t have enough information at the time of publication to evaluate actor location or motivation. Mandiant will update this blog’s attribution assessment as new information emerges from investigations.

A forensic investigation should be carried out right away by any organizations whose FortiManager may be exposed to the internet.

Exploitation Details

The first known instance of Mandiant being exploited was on June 27, 2024. Several FortiManager devices were connected to the default port TCP/541 on that day via the IP address 45[.]32[.]41[.]202. Around the same time, the file system stored the staging of different Fortinet configuration files in an archive called /tmp/.tm that was compressed using Gzip. The files and folders mentioned in below Table were included in this bundle.FilenameDescription/var/dm/RCSFolder containing configuration files of managed FortiGate devices/var/dm/RCS/revinfo.dbDatabase containing additional information of the managed FortiGate devices/var/fds/data/devices.txtContains a list of FortiGate serials and their corresponding IP addresses/var/pm2/global.dbGlobal database that contains object configurations, policy packages, and header and footer sensor configuration for IPS/var/old_fmversionContains current FortiManager version, build, and branch information

Mandiant noticed a second attempt at exploitation using the same symptoms on September 23, 2024. Outgoing network traffic happened soon after the archive was created in both exploitation scenarios. The size of the archive is marginally less than the number of bytes delivered to the corresponding destination IP addresses. The specifics of this action are listed in below Table .

The threat actor’s device was linked to the targeted FortiManager during the second exploitation attempt. Figure shows the timestamp at which the illegal FortiManager was introduced to the Global Objects database.

The threat actor’s unknown Fortinet device showed up in the FortiManager console after they had successfully exploited the FortiManager.

The files /fds/data/subs.dat and /fds/data/subs.dat.tmp contain additional indicators of the exploitation that include an associated disposable email address and a company name as listed in Figure .SerialNumber=FMG-VMTM23017412|AccountID= 0qsc137p@justdefinition.com|Company=Purity Supreme|UserID=1756868

Lack of Follow-On Malicious Activity

Mandiant examined rootfs.gz, the device’s initramfs (RAM disk) that is mounted to /bin. During the period of exploitation activity, did not discover any malicious files that had been produced or altered.

Affected clients who displayed comparable activities in their environments were alerted by Google Cloud. In order to help identify Fortinet device exploit attempts, Google Cloud Threat Intelligence also conducted retrohunts while creating detections for this activity and manually escalated Pre-Release Detection Rule notifications to impacted SecOps customers.

Apart from working with Mandiant, Fortinet made aggressive efforts to notify its clients in advance of their advise so that they may improve their security posture before it was widely made public.

Mitigation Strategies / Workaround

Restrict only authorized internal IP addresses from accessing the FortiManager admin portal.

Permitted FortiGate addresses should be the only ones allowed to connect to FortiManager.

Deny FortiManager access to unidentified FortiGate devices.

Available 7.2.5, 7.0.12, 7.4.3 and later (not functional workaround on 7.6.0). config system global set fgfm-deny-unknown enable end

Detection

YARA-L

IOCs mentioned in this blog post can be prioritized using Applied Threat Intelligence, and rules were released to the “Mandiant Intel Emerging Threats” rule pack (in the Windows Threats group) if you are a Google SecOps Enterprise+ customer.

Relevant Rules

Suspicious FortiManager Inbound and Outbound Connection

UNC5820 Fortinet Exploitation and File Download

UNC5820 Fortinet Exploitation and non-HTTPS Command and Control

UNC5820 Fortinet Exploitation and HTTPS Command and Control

Other SIEMs

Create searches for the following pertinent IOCs using Fortiguard logs. Specifically, if activated, the Malicious Fortinet Device ID need to deliver a high quality alert.

In the FortiManager logs, establish baselines and thresholds for distinct processes. Specifically, “Add device” and “Modify device” procedures can be infrequent enough for your company to issue a useful warning until this vulnerability is fixed.

In the FortiManager logs, baseline and establish thresholds for the changes field. When the word “Unregistered” appears in the changes field, take into account a higher sensitivity.

Every day, count the Fortigate devices and notify you when a device name that hasn’t been seen in the logs is detected.

Indicators of Compromise (IOCs)

Registered users can access a Google Threat Intelligence Collection of IOCs.

Read more on govindhtech.com

[projectmanagertemplate]

Prioritizing project risks is a cornerstone of successful project management. By systematically evaluating likelihood, impact, and proximity and involving stakeholders in the process you can focus on the most critical challenges, safeguard your project’s success, and use resources effectively.

[cheryltechwebz]

Streamline Risk Assessment and Mitigation 🛡️

Don't let risks catch you off guard! Our Risk Assessment and Mitigation solutions provide actionable insights to help you navigate potential threats effectively.

✅ Key Features:

Comprehensive risk analysis

Customized mitigation strategies

Continuous monitoring for emerging risks

Empower your organization to tackle risks head-on: Risk Assessment and Mitigation

[indianschool]

Extreme Weather Events and Their Impact on Human Lives | ISDM

Discover the escalating impact of extreme weather events on Indian lives and the urgent need for mitigation strategies. Authors from ISDM DataSights delve into the rising frequency of climate disasters and their socio-economic consequences.

[economystreets1]

What Are The Economic Benefits Of Investing In Flood Prevention And Mitigation Strategies?

Floods are among the most destructive natural disasters, causing significant damage to both urban and rural areas around the world. In recent years, the frequency and severity of floods have increased due to climate change and urbanization. As a result, there is a growing need for effective flood prevention and mitigation strategies.

While the upfront costs of these strategies can be substantial, the long-term economic benefits far outweigh the initial investments. In this blog post, we will explore the various economic benefits of investing in flood prevention and mitigation strategies.

Reduced Property Damage

One of the most immediate economic benefits of flood prevention and mitigation strategies is the reduction in property damage. When floods occur, homes, businesses, and infrastructure can be severely affected, leading to significant financial losses. By implementing flood prevention measures such as levees, flood walls, and improved drainage systems, the extent of property damage can be minimized. This not only saves property owners and businesses from costly repairs but also reduces the financial burden on governments and insurance companies.

Lower Insurance Costs

Frequent flooding in certain areas can result in higher insurance premiums, or in some cases, make it difficult for property owners to obtain coverage altogether. When communities invest in flood prevention and mitigation strategies, insurance companies are more likely to offer affordable policies, as the risk of flood-related claims is reduced. This, in turn, leads to cost savings for property owners and businesses.

Preservation Of Infrastructure

Floods can wreak havoc on critical infrastructure, including roads, bridges, utilities, and public transportation systems. Repairing or replacing damaged infrastructure is a costly endeavor that can strain municipal budgets. By investing in flood prevention measures that protect infrastructure, governments can save money in the long run and ensure the continued functionality of vital services.

Enhanced Agricultural Productivity

Agriculture is a sector particularly vulnerable to the impacts of flooding. Crops can be destroyed, and farmland can become unusable after a flood event. Flood prevention strategies such as the construction of retention ponds and the implementation of proper drainage systems can help protect agricultural land. By safeguarding farms and crops, communities can ensure a stable food supply and reduce the economic burden on farmers and consumers alike.

Increased Property Values

Areas prone to flooding often suffer from lower property values due to the perceived risk. When flood prevention and mitigation measures are put in place, the perceived risk decreases, leading to higher property values. This benefits homeowners and communities by increasing property tax revenue, which can be reinvested in local infrastructure and services.

Job Creation

Investing in flood prevention and mitigation strategies generates employment opportunities. Construction, engineering, and maintenance of flood control infrastructure require a skilled workforce. Additionally, the restoration efforts following a flood event can create temporary jobs. These employment opportunities contribute to economic growth and stability within a region.

Business Continuity

Businesses that are located in flood-prone areas face disruptions and financial losses when floods occur. By implementing flood prevention measures, businesses can ensure continuity of operations and protect their assets. This contributes to the overall economic resilience of a community.

Reduced Disaster Relief Costs

When floods strike, governments often allocate significant resources for disaster relief and recovery efforts. By proactively investing in flood prevention and mitigation, the frequency and severity of flood events can be reduced, leading to lower disaster relief costs over time. These funds can then be allocated to other essential services and infrastructure projects.

Conclusion

In conclusion, investing in flood prevention and mitigation strategies is not only a prudent choice for safeguarding communities against the increasing threat of floods but also a wise economic decision. The long-term benefits, including reduced property damage, lower insurance costs, preserved infrastructure, increased property values, job creation, business continuity, and reduced disaster relief costs, far outweigh the initial investments. As climate change continues to pose challenges, proactive flood prevention measures are essential for building resilient and economically vibrant communities. It is clear that the economic benefits of such investments are substantial, making flood prevention and mitigation strategies a smart choice for governments, businesses, and homeowners alike.

Source: What Are The Economic Benefits Of Investing In Flood Prevention And Mitigation Strategies?

[supedium]

The Role of Algae in Ocean Acidification Mitigation

https://supedium.com/phycology/the-role-of-algae-in-ocean-acidification-mitigation/ #Algae #Carbonsequestration #macroalgae #MitigationStrategies #oceanacidification #Phytoplankton The Role of Algae in Ocean Acidification Mitigation https://supedium.com/phycology/the-role-of-algae-in-ocean-acidification-mitigation/

[compleattsinc]

Risk Assessment and Configuration Specification Mitigate risks and ensure system integrity with our focused approach to risk assessment and configuration specification. Our services include:

● Conducting comprehensive risk assessments to identify potential vulnerabilities and implement appropriate mitigation strategies ● Developing detailed configuration specifications to ensure systems are configured in accordance with regulatory requirements and operational needs ● Implementing controls and safeguards to protect data integrity and ensure compliance with ALCOA principles

🌐 Website: www.compleatts.com 📧 Email: info@compleatts.com 📞 Phone: +1 (704) 453-8093

RiskAssessment #ConfigurationSpecification #SystemIntegrity #MitigationStrategies #DataProtection #Compliance #ALCOAPrinciples #VulnerabilityAssessment #OperationalExcellence #RegulatoryCompliance #DataIntegrity #ITSecurity #RiskManagement #CyberSecurity #SystemConfiguration

[adjeem]

Looking for ways to mitigate the impacts of climate change? Check out our latest post on adjeem.com, where we explore 5 major causes of climate change and discuss actionable steps we can take to slow it down. 🌍🌿💡

https://adjeem.com/blogs/what-are-the-5-causes-of-climate-change

[alfaauv123]

Read the blog to find out how UVGI technology can help prevent seasonal flu this monsoon.

[projectmanagertemplate]

In project management the project charter is a pivotal document that sets the foundation for a successful project. Despite its significance, the project charter is often overlooked or underutilized. In this blog, we'll explore why a project charter is crucial, what it typically includes, and how it can make the difference between a project's success and failure.