APT hacked a US municipal government via an unpatched Fortinet VPN

The FBI revealed that foreign hackers compromised the network of a local US municipal government by exploiting flaws in an unpatched Fortinet VPN.

The Federal Bureau of Investigation (FBI) reported that an APT group had breached the network of a local US municipal government by exploiting vulnerabilities in an unpatched Fortinet VPN.

“The FBI is continuing to warn about Advanced Persistent Threat (APT) actors exploiting Fortinet vulnerabilities. As of at least May 2021, an APT actor group almost certainly exploited a Fortigate appliance to access a webserver hosting the domain for a U.S. municipal government.” reads the alert issued by the FBI.

The feds uncovered the attack in May 2021, government experts reported that the threat actors likely created an account with the username “elie” to gain persistence on the network..

In April, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) previously warned of attacks carried out by APT groups targeting Fortinet FortiOS servers using multiple exploits.

The threat actors are actively exploiting the following vulnerabilities in Fortinet FortiOS:

• CVE-2018-13379;
• CVE-2020-12812;
• CVE-2019-5591

The alert published by the FBI provides technical details about the attack against the US municipal government. Experts noticed that the APT group established new user accounts that look similar to other existing accounts on the network. The attackers also used the following account usernames

• “ellie”
• “WADGUtilityAccount”

The threat actors may also have made modifications to the Task Scheduler that may display as unrecognized scheduled tasks or “actions.” In the attack analyzed by the experts the hackers have created “SynchronizeTimeZone” task.

The tools associated with this attack are:
• Mimikatz (credential theft)
• MinerGate (crypto mining)
• WinPEAS (privilege escalation)
• SharpWMI (Windows Management Instrumentation)
• BitLocker activation when not anticipated (data encryption)
• WinRAR where not expected (archiving)
• FileZilla where not expected (file transfer)

Other indicators of Compromise are included in the alert.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Fortinet VPN)

[adrotate banner=”5″]

[adrotate banner=”13″]