Week of January 13, 2025: FortiGate zero-day and config leak, and the FBI deletes PlugX

What mattered to security leaders in the week of January 13, 2025? Fortinet patched a FortiOS authentication bypass that attackers had used against exposed FortiGate firewalls, and in the same days configuration files and credentials for more than 15,000 FortiGates surfaced on an underground forum. Edge devices were the story of the week: the UK registry Nominet also disclosed a breach through an Ivanti VPN zero-day.

Fortinet fixes a FortiOS zero-day used against exposed firewalls

Fortinet patched CVE-2024-55591, an authentication bypass in FortiOS firewalls and FortiProxy web gateways that attackers had exploited as a zero-day to compromise publicly exposed FortiGate devices. Its advisory shared indicators of compromise, some of which matched a campaign Arctic Wolf had described, beginning in mid-November, involving unauthorized admin logins on firewall management interfaces and new accounts used for SSL VPN access. CISA added the flaw to its KEV catalog on January 14, alongside three exploited Hyper-V bugs from Microsoft's January updates. (Help Net Security, CISA)

Configs and credentials for 15,000 FortiGates leaked

A group calling itself Belsen_Group published a 1.6 GB archive of configuration files for more than 15,000 Fortinet FortiGate firewalls, organized by country and IP address and including lists of admin and VPN user credentials. Heise Online counted 1,603 configurations from Mexico, 679 from the US and 208 from Germany. Any organization whose firewall appeared needed to rotate credentials and review rules, whether or not the device had since been patched. (Help Net Security)

Nominet becomes the first named victim of an Ivanti Connect Secure zero-day

UK domain registry Nominet became the first publicly known victim of attacks exploiting CVE-2025-0282, a stack-based buffer overflow in Ivanti Connect Secure VPN appliances that let unauthenticated attackers install malware, tamper with the devices and move laterally. Mandiant tied the attacks to Chinese threat actors. The Shadowserver Foundation reported on January 13 that exposed vulnerable instances had fallen from 2,048 to 800 in four days. (Help Net Security)

FBI deletes PlugX malware from thousands of computers

The US Justice Department announced on Tuesday, January 14 that the FBI, with international partners, had deleted PlugX malware from thousands of infected computers worldwide. Court documents unsealed in the Eastern District of Pennsylvania said a group known as Mustang Panda or Twill Typhoon, sponsored by the People's Republic of China, used a version of PlugX to control victim machines and steal information, and had targeted US victims, European and Asian governments and businesses, and Chinese dissident groups since at least 2014. (Help Net Security)

Codefinger encrypts AWS S3 data with the victim's own cloud features

Halcyon researchers described a gang dubbed Codefinger that uses previously compromised AWS keys with read and write rights on S3 to re-encrypt stored objects using server-side encryption with customer-provided keys (SSE-C), then demands payment for the key. The attackers do not exfiltrate data first; instead they mark the files for deletion within seven days to add pressure. Long-lived access keys with broad S3 write rights are the exposure to review. (Help Net Security)

European Commission presents a healthcare cybersecurity action plan

The European Commission presented an EU action plan to strengthen the cybersecurity of hospitals and healthcare providers, noting that member states reported 309 significant cybersecurity incidents in the health sector in 2023, more than in any other critical sector. Among its proposals, ENISA would set up a pan-European Cybersecurity Support Centre offering hospitals tailored guidance, tools, services and training. (Help Net Security)