Brazen Bamboo Weaponizes Forti Client Vulnerability to Steal VPN Credentials via DEEPDATA
Summary: Volexity identified exploitation of a zero-day credential disclosure vulnerability in Fortinet's Windows VPN client that let the DEEPDATA malware extract usernames, passwords, remote gateways, and ports from the client process memory, working against the latest version at discovery (v7.4.0) but not older versions. Volexity notified Fortinet on July 18, 2024, and attributes DEEPDATA to a Chinese state-affiliated actor it tracks as BrazenBamboo, which it links to the LIGHTSPY, DEEPDATA, and DEEPPOST malware families.
Bottom line: A state-affiliated developer built a plugin specifically to pull VPN credentials out of FortiClient's memory, and at publication the flaw had no CVE and no fix from Fortinet - meaning every Windows FortiClient user's gateway credentials were a target with no patch to apply.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026