Researchers published exploit code for a critical FortiSIEM path traversal bug that could let unauthenticated attackers run code. The flaw is described as recently patched.
Authorities across 21 countries arrested more than 1,400 suspects and recovered over $105 million in illegal funds during a two-month crackdown on business email compromise, ransomware and online scams.
A suspected state-sponsored group used a FortiManager flaw for initial access, then a path traversal bug to gain root and deploy the PeerStitch implant, researchers say.
A joint investigation describes bulk scanning of FortiGate, FortiWeb and Palo Alto GlobalProtect appliances, credential theft and hands-on-keyboard intrusions, with victim overlaps seen at Qilin and The Gentlemen.