Week of October 21, 2024: FortiManager Zero-Day Fallout and PRC Telecom Intrusion

Security leaders watched a critical FortiManager zero-day escalate into mass exploitation tied to a newly identified threat cluster, while the FBI and CISA confirmed a PRC-linked intrusion into US telecommunications infrastructure. The same week brought fresh Cisco and VMware patch bundles, an $859 million Sophos-Secureworks acquisition, and a Form 8-K disclosure of unauthorized system access at Karat Packaging.

CISA Adds Actively Exploited FortiManager Flaw to KEV Catalog

On October 23, 2024, CISA added CVE-2024-47575, a Fortinet FortiManager missing-authentication vulnerability, to its Known Exploited Vulnerabilities Catalog, citing confirmed active exploitation by Fortinet. The agency directed federal civilian agencies to apply vendor patches under Binding Operational Directive 22-01 and pointed administrators to Fortinet's own advisory FG-IR-24-423 for remediation guidance. For CISOs running managed Fortinet environments, the addition signaled that attackers were already using the flaw in the wild, making urgent patching and access restriction to FortiManager instances a priority. (CISA)

Mandiant Ties Mass FortiManager Exploitation to New UNC5820 Cluster

Fortinet confirmed that CVE-2024-47575, a FortiManager authentication-bypass flaw, had been exploited as a zero-day, with attackers exfiltrating configuration data, IP addresses, credentials, and settings from managed devices. On October 24, 2024, Mandiant said it had worked with Fortinet to investigate mass exploitation across more than 50 potentially compromised FortiManager appliances across multiple industries, attributing the activity to a newly tracked cluster, UNC5820, that had been active since June 27, 2024. Fortinet stated it had not found evidence of malware installed on compromised systems. (Help Net Security)

FBI and CISA Confirm PRC-Linked Intrusion into US Telecom Infrastructure

On October 25, 2024, the FBI and CISA issued a joint statement confirming that the U.S. government was investigating unauthorized access to commercial telecommunications infrastructure by actors linked to the People's Republic of China. The agencies said they had notified affected companies, provided technical assistance, and shared information to help other potential victims after the FBI identified targeted malicious activity. The statement noted the investigation remained ongoing and urged organizations that believed they were affected to contact their local FBI field office or CISA directly. (CISA)

Cisco Ships Semiannual ASA/FMC/FTD Bundle as CISA Flags Exploited DoS Flaw

On October 24, 2024, CISA highlighted Cisco's semiannual security advisory bundle covering Cisco ASA, FMC, and FTD software, warning that a threat actor could exploit some of the addressed vulnerabilities to take control of an affected system. The same day, CISA separately added CVE-2024-20481, a Cisco ASA and FTD denial-of-service vulnerability, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, giving federal civilian agencies a remediation deadline and prompting network teams to prioritize the bundle's patches. (CISA)

Broadcom Re-Patches Critical VMware vCenter RCE Flaw

On October 22, 2024, Broadcom re-released patches for two VMware vCenter Server vulnerabilities, CVE-2024-38812 and CVE-2024-38813, after acknowledging its original fix had not fully resolved the heap-overflow flaw. CVE-2024-38812 could allow unauthenticated remote code execution via a crafted network packet, while CVE-2024-38813 could let an attacker escalate privileges to root. The updates applied to vCenter 7.0.3, 8.0.2, and 8.0.3 and to VMware Cloud Foundation, and Broadcom urged customers managing virtualized environments to apply the new patches without delay. (Help Net Security)

Sophos to Acquire Secureworks for $859 Million

On October 22, 2024, Sophos and Secureworks announced a definitive agreement under which Sophos would acquire Secureworks in an all-cash deal valued at approximately $859 million, with Secureworks shareholders, including Dell Technologies, receiving $8.50 per share. Sophos said the combination would add Secureworks' Taegis XDR platform, security-operations expertise, and threat intelligence to its managed-detection and endpoint portfolio. The transaction, backed by Thoma Bravo, was expected to close in early 2025 subject to customary closing conditions, a move CISOs evaluating MDR and XDR vendors would want tracked. (Help Net Security)

Karat Packaging Discloses Unauthorized Access to Information Systems in 8-K

In a Form 8-K filed with the SEC on October 23, 2024, Karat Packaging Inc. disclosed that it had discovered unauthorized third-party access to its information systems, activated its cybersecurity response plan, and notified federal law enforcement. The company said its investigation remained ongoing but that, based on current knowledge, it believed the incident was not material and had not disrupted business operations. The filing, signed by Chief Financial Officer Jian Guo, stated Karat would reassess materiality if the facts changed, per Item 1.05 of Form 8-K. (SEC EDGAR)