China-Backed Hackers Exploit Fortinet Flaw, Infecting 20,000 Systems Globally
State-sponsored threat actors backed by China gained access to 20,000 Fortinet FortiGate systems worldwide by exploiting a known critical security flaw between 2022 and 2023, indicating that the operation had a broader impact than previously known.
“The state actor behind this campaign was already aware of this vulnerability in FortiGate systems at least two months before Fortinet disclosed the vulnerability,” the Dutch National Cyber Security Centre (NCSC) said in a new bulletin. “During this so-called zero-day period, the actor alone infected 14,000 devices.”
The campaign targeted dozens of Western governments, international organizations, and a large number of companies within the defense industry. The names of the entities were not disclosed.
The findings build on an earlier advisory from February 2024, which found that the attackers had breached a computer network used by the Dutch armed forces by exploiting CVE-2022-42475 (CVSS score: 9.8), which allows for remote code execution.
Source: The Hacker News