Threat Source newsletter (June 17, 2021)
Summary: Cisco Talos reported that Agrius, an APT with potential connections to Iran, is spreading a new wiper malware disguised as ransomware that deletes victims' files completely while still claiming their data was stolen and encrypted to collect a ransom, using a backdoor called IPsec Helper and exploiting CVE-2018-13379, a long-fixed path traversal vulnerability in Fortinet's FortiOS. Talos also described BazarLoader actors using a fake video streaming site called "BravoMovies" from a company called UrbanCinema, advertised through emails, to lure victims into downloading the trojan, which is commonly used to download and execute other malicious files.
What's compelling: Agrius destroys files outright but still demands payment, so an organization hit by this wiper loses its data whether or not it pays - and the entry point is a vulnerability in FortiOS that was patched years ago, meaning unpatched edge devices remain the open door.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Mentions
- CVE-2018-13379
- Related
- CVE-2018-13379: Fortinet FortiOS SSL VPN Path Traversal Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Threat Advisory: NSA SVR Advisory Coverage Cyber Risks ·