Storm Watch | Cyber Podcast | From Bans to Breaches: TikTok, PlugX, Forti Gate, and Salt Typhoon

Summary: The Belsen Group released sensitive configuration data from more than 15,000 FortiGate devices, exposing firewall rules, VPN credentials, and digital certificates, with the leak stemming from a 2022 authentication bypass vulnerability (CVE-2022-40684) and primarily affecting devices in Mexico and the UAE. The episode also covers the Justice Department and FBI removing PlugX malware deployed by China-backed hackers, CISA Director Jen Easterly's comments on the Salt Typhoon campaign, and the Supreme Court's unanimous January 2025 decision upholding the federal TikTok ban law.
Key Takeaway: More than 15,000 FortiGate devices had their firewall rules, VPN credentials, and digital certificates published from a vulnerability patched back in 2022 - a reminder that unpatched edge devices become someone else's map of your network.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2022-40684
Related: CVE-2022-40684: Fortinet Multiple Products Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Oct 11, 2022
Hackers Actively Exploiting Fortinet Firewalls: Real-Time Insights from Grey Noise | Grey Noise Blog Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026