Threat actors who previously compromised numerous Fortinet firewalls are now reportedly collaborating with ransomware groups, including those behind the INC and LYNX ransomware strains. This collaboration appears to be a strategy to monetize the initial access gained through exploiting vulnerabilities in Fortinet devices.
The attackers have successfully established a presence within thousands of Fortinet firewalls. This widespread access provides them with a significant platform from which to launch further attacks or sell the compromised infrastructure to other malicious actors.
In addition to exploiting Fortinet devices, the same threat actors are also leveraging a separate zero-day vulnerability affecting Nextcloud, a popular open-source file-sharing and collaboration platform. This indicates a multi-pronged approach to their malicious activities, utilizing different attack vectors to maximize their impact and reach.
The combination of compromising network infrastructure like firewalls and exploiting widely used collaboration tools suggests a sophisticated operation aimed at both gaining initial access and escalating their privileges within targeted environments.
While the specific details of the collaboration between the Fortinet firewall attackers and the ransomware gangs are not fully elaborated, the involvement of INC and LYNX ransomware indicates a clear intent to encrypt data and demand ransoms from victims.
The exploitation of Fortinet firewalls likely provides attackers with deep visibility into network traffic and the ability to intercept or redirect data. This access can be invaluable for reconnaissance and for identifying high-value targets within an organization.
The simultaneous use of a Nextcloud zero-day further broadens the attack surface. Exploiting this vulnerability could allow attackers to gain unauthorized access to sensitive documents and user credentials stored on Nextcloud instances.
The implications of these combined attacks are significant, potentially leading to widespread data breaches, ransomware encryption, and disruption of critical business operations. Organizations relying on Fortinet firewalls and Nextcloud instances are urged to remain vigilant.
While specific patches for the Nextcloud zero-day are not detailed in the provided information, it is crucial for organizations to apply all available security updates for their Fortinet devices and Nextcloud installations. Implementing robust security practices, such as network segmentation, regular security audits, and prompt patching of known vulnerabilities, remains a fundamental defense against such evolving threats.
