What is the Attack?

What is the recommended Mitigation?

Mitigation & Recommendations

• Apply the latest Microsoft patches addressing CVE-2026-32202 and related vulnerabilities

• Disable or restrict NTLM authentication where possible

• Implement SMB signing and enforce Extended Protection for Authentication (EPA)

• Monitor for anomalous outbound authentication attempts (e.g., SMB/HTTP to untrusted hosts)

• Block or inspect suspicious LNK file delivery vectors

Detection Opportunities

• Outbound NTLM authentication attempts to unknown or external IPs

• Suspicious LNK file execution or delivery patterns

• Indicators tied to known APT28 infrastructure or tactics

What FortiGuard Coverage is available?

• FortiGuard Intrusion Prevention System (IPS) Service: FortiGuard IPS provides coverage to detect and block exploitation attempts targeting CVE-2026-32202. Intrusion Prevention | FortiGuard Labs

• FortiGuard Antivirus & Behavior Detection: Protects against malicious payloads and post-exploitation activity, including detection of suspicious LNK file execution, abnormal authentication behavior, and attempts to coerce outbound NTLM authentication to attacker-controlled infrastructure.

• FortiGuard Endpoint Vulnerability Service provides a systematic and automated method of patching, eliminating manual processes while reducing the attack surface for CVE-2026-21510, CVE-2026-21513, and CVE-2026-32202 .
Endpoint Vulnerability | FortiGuard Labs
Endpoint Vulnerability | FortiGuard Labs
Endpoint Vulnerability | FortiGuard Labs

• FortiGuard Incident Response: Organizations that suspect exposure to exploitation activity linked to APT28 or these vulnerabilities should engage FortiGuard Incident Response for rapid investigation, credential exposure assessment, containment, and remediation.

• FortiGuard Web Filtering: Blocks access to known malicious domains and attacker-controlled servers used for NTLM hash capture, payload delivery, and command-and-control communication

What is the Vulnerability?

What is the recommended Mitigation?

• Immediate Actions: Upgrade to:
ActiveMQ 5.19.4+
ActiveMQ 6.2.3+

• Restrict access to ActiveMQ web console (port 8161)
• Disable or tightly restrict Jolokia API
• Enforce strong authentication; remove default credentials
• Limit MBean execution permissions
• Place management interfaces behind VPN or internal networks
• Monitor for abnormal Jolokia API usage
• Inspect logs for MBean exec calls
• Track outbound connections to untrusted hosts
• Use EDR to detect suspicious Java child processes

What FortiGuard Coverage is available?

• FortiGuard Intrusion Prevention System (IPS) Service: FortiGuard IPS Service is available to detect and block exploit attempts targeting CVE-2026-34197.

• FortiGuard Antivirus & Behavior Detection: Protects against known malware and leverages advanced behavioral analysis to detect suspicious activity, including abnormal process execution originating from exploited ActiveMQ services.

• FortiGuard Incident Response: Organizations that suspect exposure or compromise involving vulnerable Apache ActiveMQ instances should engage FortiGuard Incident Response for rapid investigation, containment, and remediation.

• FortiGuard Web Filtering: Prevent access to malicious payload hosting.

What is the Attack?

What is the recommended Mitigation?

• Patch immediately: Prioritize newly disclosed vulnerabilities affecting internet-facing systems
• Reduce attack surface: Restrict or isolate exposed services and admin interfaces
• Monitor RMM usage: Detect abnormal use of tools like AnyDesk, ScreenConnect, or similar
• Harden identity security: Enforce MFA and monitor for anomalous account creation
• Enhance detection: Focus on early indicators such as unusual authentication, privilege escalation, and data movement

What FortiGuard Coverage is available?

• FortiGuard IPS Service: Detects and blocks exploit attempts targeting vulnerable web-facing assets.
• FortiGuard Antivirus & Behavior Detection: Identifies Medusa ransomware and suspicious post-exploitation activity.
• FortiGuard Labs Threat Intelligence: Continuously tracks Storm-1175 activity, emerging CVEs, and IOCs.
• FortiGuard Incident Response: Provides rapid containment, forensic investigation, and recovery support for impacted organizations.

What is the Attack?

What is the recommended Mitigation?

• Immediate Actions:
  Upgrade TrueConf clients to version 8.5.3 or later (patched)
  Validate the integrity of internal update mechanisms

• Detection & Hardening:
  Monitor for anomalous update behavior and execution flows
  Inspect internal server-to-endpoint traffic for suspicious payloads
  Deploy EDR to detect post-exploitation frameworks (e.g., Havoc)
  Enforce application allowlisting for update processes

• Network & Architecture:
  Segment systems running collaboration tools
  Restrict administrative access to update servers
  Apply least privilege across endpoints

• Threat Hunting Focus:
  Unexpected executable downloads from internal servers
  DLL sideloading patterns
  Unusual outbound connections from collaboration software

What FortiGuard Coverage is available?

• FortiGuard IPS Coverage:
  FortiGuard provides detection coverage for Havoc-related activity through IPS signature Backdoor.Havoc.Agent (ID: 52655). This signature detects traffic associated with the Havoc C2 framework.

• FortiGuard Endpoint Security (AV & Behavior Detection):
  FortiGuard provides detection coverage for malicious update-based execution, DLL sideloading techniques, and Havoc-related post-exploitation activity. Behavioral detection capabilities help identify abnormal process execution originating from trusted applications and detect unauthorized outbound C2 communications.

• FortiGuard Incident Response:
  Organizations that suspect exposure to compromised TrueConf update infrastructure or potential exploitation of CVE-2026-3502 should engage FortiGuard Incident Response for rapid investigation, containment, and remediation. FortiGuard IR provides expert-led analysis to identify affected endpoints, trace malicious update propagation, and eradicate deployed payloads, including Havoc C2 agents.

• FortiGuard Labs Threat Intelligence:
  FortiGuard Labs is actively monitoring Operation TrueChaos and related activity involving abuse of trusted software update mechanisms. This includes tracking exploitation of CVE-2026-3502, malicious update delivery techniques, DLL sideloading chains, and deployment of the Havoc command-and-control framework.

What is the Attack?

What is the recommended Mitigation?

To mitigate this vulnerability, users of affected packages should immediately downgrade to safe versions and audit their environments for indicators of compromise. Treat affected systems as fully compromised and perform the following actions:

• Identify and remove:
  axios@1.14.1, axios@0.30.4
  plain-crypto-js
  Treat affected systems as fully compromised

• Rotate:
  Credentials, tokens, API keys
  Rebuild environments from a trusted baseline

• Enforce:
  Dependency pinning
  Install script restrictions (--ignore-scripts)
  Supply chain monitoring controls

What FortiGuard Coverage is available?

• FortiCNAPP: Protects against the Axios npm supply-chain compromise by providing end-to-end visibility and threat detection across development, build, and runtime environments.
  
  At runtime, it uses behavioral analytics and composite alerts to flag suspicious processes, cross-platform RAT artifacts, and network communication with attacker infrastructure, enabling rapid identification and containment of compromised systems. Continuous threat intelligence updates ensure detection of evolving supply chain attacks, while automated prioritization and remediation guidance help organizations isolate affected hosts, remove malicious dependencies, and restore trusted development and production environments.
  
  Read the full solution: How does Lacework FortiCNAPP Protect | Fortinet Community

• FortiGuard Incident Response: Organizations that suspect exposure to the compromised axios npm package (1.14.1, 0.30.4) should engage FortiGuard Incident Response for rapid investigation, containment, and recovery. FortiGuard IR provides expert-led analysis to identify affected systems and remove malicious dependencies.

• FortiGuard Labs Threat Intelligence: FortiGuard Labs is actively monitoring software supply chain attacks targeting open-source ecosystems, including the axios compromise. This activity involves malicious package publication via compromised maintainer accounts, use of phantom dependencies, and post-install script execution to deploy cross-platform RAT payloads. Ongoing tracking includes malicious package versions, dependency abuse techniques, command-and-control infrastructure, and downstream impact across developer and enterprise environments. Intelligence updates, IOCs, and mitigation guidance will be continuously refined as additional data becomes available.

• FortiGuard Antivirus & Behavior Detection: FortiGuard provides detection coverage for RAT payloads and malicious post-install behaviors associated with compromised npm packages.

What is the Attack?

What is the recommended Mitigation?

• Immediate Patching:
  Upgrade iOS devices beyond affected versions as security updates become available

• Web Filtering & DNS Security:
  Block access to suspicious or newly registered domains used in exploit delivery

• High-Risk User Protection:
  Enforce stricter controls (device hardening, limited browsing exposure) for sensitive roles

• Threat Intelligence Integration:
  Continuously ingest indicators related to DarkSword infrastructure and malware families

What FortiGuard Coverage is available?

• FortiGuard Incident Response: Organizations that suspect compromise of iOS devices via the DarkSword exploit chain should engage FortiGuard Incident Response for rapid investigation, containment, forensic analysis, and recovery support. Focus areas include identification of exploit-triggering web activity, analysis of post-exploitation malware (GHOSTBLADE, GHOSTKNIFE, GHOSTSABER), validation of device compromise scope, and detection of potential data exfiltration or persistent surveillance mechanisms.

• FortiGuard Labs Threat Intelligence: FortiGuard Labs is actively monitoring threat activity associated with DarkSword and related mobile exploitation frameworks identified by Google Threat Intelligence Group.

• FortiGuard Antivirus & Behavior Detection: Protects against post-exploitation malware families associated with DarkSword, including GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. Virus | FortiGuard Labs

• FortiGuard Indicators of Compromise (IOCs) Service: FortiGuard Labs has blocked all known DarkSword-associated indicators, including malicious domains used for exploit delivery, watering hole infrastructure, and command-and-control endpoints

What is the Attack?

What is the recommended Mitigation?

• Harden endpoint management configurations (Intune and equivalents).
• Enforce MFA and strong identity controls for admin access.
• Restrict and monitor privileged device management actions.
• Apply Microsoft hardening guidance and security baselines.
• Audit device enrollment and policy deployment mechanisms.

What FortiGuard Coverage is available?

• FortiGuard Incident Response: Organizations that suspect compromise of endpoint management infrastructure (e.g., Microsoft Intune or equivalent platforms) should engage FortiGuard Incident Response for rapid investigation, containment, forensic analysis, and recovery support. Focus areas include privileged account abuse, unauthorized policy deployment, and potential destructive actions across managed endpoints.

• FortiGuard Labs Threat Intelligence: FortiGuard Labs is actively monitoring ongoing threat activity involving the targeting of endpoint management systems and associated destructive campaigns. This includes tracking Iran-linked actor activity (e.g., Handala), evolving wiper malware techniques, and abuse of centralized device management platforms. Continuous intelligence updates, indicators of compromise (IOCs), and mitigation guidance will be provided as new information emerges.

• FortiGuard Antivirus & Behavior Detection: Provides protection against known malware and destructive tooling, including wiper malware and post-compromise payloads. Advanced behavioral detection identifies abnormal endpoint management actions, privilege misuse, and mass-impact operations, enabling early detection and prevention of large-scale device disruption.

What are the Vulnerabilities?

What is the recommended Mitigation?

• A patch is available; please refer to the Security Advisory Ivanti Connect Secure, Policy Secure & ZTA Gateways (CVE-2025-0282, CVE-2025-0283)

• The Integrity Checker Tool (ICT) provided by Ivanti to ensure the integrity and security of the entire network infrastructure can identify exploitation of CVE-2025-0282.

• CISA has also provided Mitigation Instructions for CVE-2025-0282: https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282

What FortiGuard Coverage is available?

• FortiGuard Labs recommends users to apply the fix provided by the vendor and follow instructions as mentioned on the vendor’s advisory.

• FortiGuard Labs has blocked all the known malware and related Indicators of Compromise (IOCs) noted on the campaign targeting the Ivanti vulnerability.

• FortiGuard Labs has available IPS protection to detect and block any attack attempts targeting the (CVE-2025-0282), Buffer Overflow vulnerability in Ivanti Connect Secure. Intrusion Prevention | FortiGuard Labs.

• The FortiGuard Incident Response team can be engaged to help with any suspected compromise.

What is the Attack?

What is the recommended Mitigation?

• Immediately upgrade vulnerable instances of Dell RecoverPoint for Virtual Machines to the fixed release. Dell has released remediations for CVE-2026-22769, and customers are urged to follow the guidance in the official Security Advisory. DSA-2026-079: Security Update for RecoverPoint for Virtual Machines Hardcoded Credential Vulnerability | Dell US
• Restrict the network exposure of RecoverPoint appliances. Ensure the management interface is not internet-facing.
• Conduct post-exploitation validation and threat hunting. Review appliance logs for unusual authentication activity.

What FortiGuard Coverage is available?

• FortiGuard Labs is actively monitoring exploitation activity associated with the UNC6201 campaign targeting Dell RecoverPoint for VM. The team continues to track evolving attacker infrastructure, tooling, and tactics, and will provide ongoing intelligence updates, newly identified indicators, and protection guidance as the situation develops.

• FortiGuard Antivirus & Behavior Detection protects against known malware families associated with this activity and leverages advanced behavioral analysis to detect and block previously unseen variants, including web shells and custom backdoors deployed post-exploitation.

• Indicators of Compromise (IOC) Service: FortiGuard Labs has implemented protections to block all currently known malicious indicators linked to this campaign. Continuous monitoring ensures the rapid addition of newly discovered hashes, domains, IP addresses, and behavioral artifacts.

• FortiGuard Incident Response: Organizations that suspect compromise can engage the FortiGuard Incident Response team for rapid investigation, containment, forensic analysis, and remediation support to minimize operational and security impact.

What is the Vulnerability?

What is the recommended Mitigation?

• Apply vendor patches immediately for all affected ZCS versions (Zimbra Collaboration (ZCS) 10.0 – 10.0.17- Zimbra Collaboration (ZCS) 10.1.0 – 10.1.12), and Fixed versions are 10.0.18 and 10.1.13.
• Restrict access to Zimbra Webmail interfaces from untrusted networks.
• Hunt for anomalous file inclusion requests and unauthorized file access patterns.

What FortiGuard Coverage is available?

• FortiGuard Intrusion Prevention System (IPS) Service: FortiGuard IPS Service is available to detect and block exploit attempts targeting CVE-2025-68645. Intrusion Prevention | FortiGuard Labs
• FortiGuard Antivirus & Behavior Detection: Delivers protection against known malware and uses advanced behavioral analysis to detect and block unknown threats.
• Indicators of Compromise (IOCs) Service: The FortiGuard team is continuously monitoring for emerging threats and new IOCs.
• FortiGuard Incident Response: Organizations suspecting a compromise can contact the FortiGuard Incident Response team for rapid investigation and remediation support.