APT hacked a US municipal government via an unpatched Fortinet VPN

The FBI revealed that foreign hackers compromised the network of a local US municipal government by exploiting flaws in an unpatched Fortinet VPN.

The Federal Bureau of Investigation (FBI) reported that an APT group had breached the network of a local US municipal government by exploiting vulnerabilities in an unpatched Fortinet VPN.

“The FBI is continuing to warn about Advanced Persistent Threat (APT) actors exploiting Fortinet vulnerabilities. As of at least May 2021, an APT actor group almost certainly exploited a Fortigate appliance to access a webserver hosting the domain for a U.S. municipal government.” reads the alert issued by the FBI.

The feds uncovered the attack in May 2021, government experts reported that the threat actors likely created an account with the username “elie” to gain persistence on the network..

In April, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) previously warned of attacks carried out by APT groups targeting Fortinet FortiOS servers using multiple exploits.

The threat actors are actively exploiting the following vulnerabilities in Fortinet FortiOS:

The alert published by the FBI provides technical details about the attack against the US municipal government. Experts noticed that the APT group established new user accounts that look similar to other existing accounts on the network. The attackers also used the following account usernames

“ellie”
“WADGUtilityAccount”

The threat actors may also have made modifications to the Task Scheduler that may display as unrecognized scheduled tasks or “actions.” In the attack analyzed by the experts the hackers have created “SynchronizeTimeZone” task.

The tools associated with this attack are:
• Mimikatz (credential theft)
• MinerGate (crypto mining)
• WinPEAS (privilege escalation)
• SharpWMI (Windows Management Instrumentation)
• BitLocker activation when not anticipated (data encryption)
• WinRAR where not expected (archiving)
• FileZilla where not expected (file transfer)

Other indicators of Compromise are included in the alert.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Fortinet VPN)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.