پارتیان

FortiGuard Labs | FortiGuard Center - Threat Signal Report

The Threat Signal created by the FortiGuard Labs is intended to provide you with insight on emerging issues that are trending within the cyber threat landscape. The Threat Signal will provide concise technical details about the issue, mitigation recommendations and a perspective from the FortiGuard Labs team in an FAQ style format.

What is the Vulnerability?

React2Shell is a critical unauthenticated RCE vulnerability impacting React Server Components (RSC) and frameworks that implement the Flight protocol, including affected versions of Next.js. A remote attacker can send a specially crafted RSC request that triggers server-side deserialization and arbitrary code execution with no user interaction required.

Exploitation enables full server takeover, installation of backdoors, credential harvesting, and lateral movement. Given the widespread adoption of React/Next.js in production environments, organizations should patch immediately, enforce WAF restrictions on RSC endpoints, and conduct proactive hunts for suspicious Node.js process spawning, abnormal RSC requests, or unexpected outbound connections.

Some publicly circulating proofs-of-concept (PoCs) appear incomplete or misleading, and should be treated cautiously until validated.

CISA has added CVE-2025-55182 to the Known Exploited Vulnerabilities (KEV) catalog following evidence of active exploitation on 5 December 2025.

AWS Security has identified exploitation activity originating from IP addresses and infrastructure historically associated with known China state-nexus threat actors. China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) | AWS Security Blog

What is the recommended Mitigation?

  • React Server-Side Flight Libraries:
    react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack (specific vulnerable versions are outlined in the vendor advisories).

  • Frameworks Implementing RSC/Flight:
    Frameworks such as Next.js (notably certain versions within the 15–16 range) and other ecosystem frameworks that embed React Server Components (RSC) or Flight functionality.

  • Organizations should review the vendor advisories for complete version details, mitigation steps, and updated guidance.

What FortiGuard Coverage is available?

  • FortiGuard Web Application Security, delivered through the FortiWeb ( Web Application Firewall (WAF) & API Protection ), protects web applications by detecting and blocking exploit attempts targeting vulnerable web servers and application components.
    https://www.fortiguard.com/encyclopedia/fwb/1090502460
    https://www.fortiguard.com/encyclopedia/fwb/1090502462

  • FortiAnalyzer, FortiSIEM, and FortiSOAR integrate known Indicators of Compromise (IoCs) via the IoC Service, enabling advanced threat hunting, automated correlation, and rapid incident response. FortiGuard Labs continuously monitors for newly emerging IoCs, ensuring proactive protection against evolving threat activity.

  • Lacework FortiCNAPP Cloud Team is actively assessing the impact of the React2Shell vulnerabilities across cloud workloads and has published a supporting Knowledge Base (KB) article as part of their ongoing response. How does Lacework FortiCNAPP Protect from... - Fortinet Community

  • Lacework FortiCNAPP automatically identifies vulnerable packages within customer environments through its Vulnerability Management and Code Security components.

  • Organizations that suspect potential compromise are encouraged to contact the FortiGuard Incident Response team for rapid investigation and remediation support.

What is the Vulnerability?

CVE-2025-61757 is a critical pre-authentication remote code execution vulnerability in Oracle Identity Manager’s REST WebServices. This vulnerability allows an unauthenticated attacker to exploit URI and matrix parameter parsing weaknesses to bypass authentication and execute arbitrary code over HTTP.

Successful exploitation results in full compromise of Identity Manager servers- enabling attackers to steal credentials, escalate privilege across connected systems, move laterally within the infrastructure, and persist undetected. As Identity Manager is a core identity and access control system, the downstream impact is severe, including potential domain or cloud takeover.

This vulnerability has been assigned a CVSS 9.8 (Critical) rating and is considered easily exploitable. The U.S. CISA has added the associated CVE to its Known Exploited Vulnerabilities (KEV) catalog, indicating active or imminent exploitation in the wild.

What is the recommended Mitigation?

  • Apply Oracle’s October 2025 Critical Patch Update for CVE-2025-61757 immediately . This patch directly addresses the authentication bypass and pre-auth RCE path for affected Oracle Identity Manager/Identity Governance REST WebServices:
    12.2.1.4.0
    14.1.2.1.0

  • Restrict network access to OIM/OIG management endpoints- block direct exposure to the internet and allow access only from trusted administrative networks.

  • Monitor and control outbound connections from Identity Manager servers:

    • Watch for unexpected callbacks, external network beacons, or suspicious DNS resolutions.

    • Implement egress allowlists for management servers to prevent command-and-control style communications.

    • If a compromise is suspected, rotate service accounts and identity-related credentials.

What FortiGuard Coverage is available?

  • FortiGuard IPS Service is available to detect and block exploit attempts targeting CVE-2025-61757. Intrusion Prevention | FortiGuard Labs

  • FortiGuard Web Filtering Service protects against malicious URLs, domains, IPs, and other attacker-controlled infrastructure associated with this campaign.

  • FortiAnalyzer, FortiSIEM, and FortiSOAR leverage known Indicators of Compromise (IoCs) delivered through the Indicators of Compromise (IoC) Service to enhance threat hunting, detection, and automated response, strengthening investigation workflows and correlation against related threat activity. FortiGuard Labs continues to monitor for newly emerging IoCs to ensure proactive protection.

  • Organizations suspecting a compromise can contact the FortiGuard Incident Response team for rapid investigation and remediation support.

What is the Attack?

A suspected Iran-linked espionage group tracked as UNC1549 is actively targeting aerospace, defense, and telecommunications organizations across Europe and other regions. The threat actor employs a combination of highly tailored spear-phishing, credential theft from third-party services, and abuse of virtual desktop infrastructure such as Citrix, VMware, and Azure VDI to gain initial access and move laterally within target networks.

These activities align with state-sponsored intelligence objectives, including the theft of sensitive technical data, monitoring of communications, and long-term strategic positioning within high-value targets.

UNC1549 employs a range of custom malware families and stealth techniques to maintain persistent and covert access. MINIBIKE is a modular backdoor used to steal credentials, log keystrokes, capture screenshots, and deploy additional payloads. TWOSTROKE enables remote access, system control, and persistence, while DEEPROOT extends similar functionality to Linux environments. For stealthy command-and-control, the group leverages LIGHTRAIL and GHOSTLINE, tunneling tools that disguise malicious communications within legitimate cloud traffic to facilitate covert data exfiltration and resilient connectivity.

What is the recommended Mitigation?

  • Review FortiEDR / FortiEndpoint alerts for MINIBIKE, TWOSTROKE, and DEEPROOT activity.

  • Investigate unusual network traffic correlating with LIGHTRAIL or GHOSTLINE C2 patterns.

  • Audit third-party and supplier accounts for suspicious activity or unauthorized access.

  • Ensure MFA, patching, and access control policies are enforced across high-value systems.

  • Maintain ongoing threat intelligence updates to respond to emerging UNC1549 Tactics, Techniques, and Procedures (TTPs) and Indicators of Compromise (IoCs).

  • Monitor for suspicious third-party access or anomalous account activity.

  • Implement multi-factor authentication (MFA) and strict supplier access controls.

  • Apply least privilege principles for VDI and remote access services (Citrix, VMware, Azure VDI).

What FortiGuard Coverage is available?

  • Endpoint Protection:
    - FortiEDR / FortiEndpoint detects and blocks MINIBIKE, TWOSTROKE, and DEEPROOT malware families.
    - FortiSandbox and FortiEDR behavior-based detection identify unknown malware, persistence techniques, and unauthorized system modifications.

  • Network & Exploit Protection:
    - FortiGuard IPS Service detects and blocks exploit attempts targeting vulnerabilities leveraged by UNC1549.
    - FortiGuard Web Filtering Service protects against malicious URLs, domains, IPs, and other attacker-controlled infrastructure linked to this campaign.

  • Threat Hunting & Incident Response:
    - FortiAnalyzer, FortiSIEM, and FortiSOAR integrate known Indicators of Compromise (IoCs) via the IoC Service, enabling advanced threat hunting, automated correlation, and rapid incident response.
    - FortiGuard Labs continuously monitors for newly emerging IoCs, ensuring proactive protection against evolving threat activity.

  • Organizations suspecting compromise can contact the FortiGuard Incident Response team for rapid investigation and remediation support.

What is the Attack?

On November 24, 2025, Shai Hulud launches a second supply-chain attack, compromising Zapier, ENS, AsyncAPI, PostHog, and Postman, along with over 25,000 affected repositories across ~350 unique users.
Shai Hulud 2.0 Strikes Again: Malware Supply-Chain Attack Hits Zapier & ENS Domains

On September 8, 2025, attackers phished the npm maintainer “qix” and stole their two-factor authentication (2FA) credentials. With that access, they published malicious versions of some very popular npm packages (including debug, chalk, and ansi-styles).

The impact is considered high risk for applications that serve frontend JavaScript, especially those handling payments, cryptocurrency, or wallet flows. Reports indicate that these compromised versions were live for about two hours before removal.

According to the CISA Alert on this incident, the campaign also involved a self-replicating worm publicly known as “Shai-Hulud,” which compromised over 500 packages. After gaining initial access, the malicious actor deployed malware that scanned environments for sensitive credentials. The attacker specifically targeted GitHub Personal Access Tokens (PATs) and API keys for major cloud platforms, including Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.

What is the recommended Mitigation?

  • Dependency Controls
    - Pin dependencies to known-safe versions.
    - Blocklist malicious versions in private registries/proxies.
    - Rebuild from a clean state and invalidate CDN caches.

  • Credential Hygiene
    - Rotate npm, GitHub, and cloud tokens.
    - Enforce phishing-resistant MFA (e.g., hardware keys).

  • CI/CD Hardening
    - Audit secrets, webhooks, and GitHub Actions.
    - Enable secret scanning and branch protections.
    - Add guardrails to detect tampered dependencies before production build.

  • Network & Runtime Defense
    - Block outbound traffic to known exfiltration domains.
    - Continuously monitor for new IoCs related to npm compromise.

What FortiGuard Coverage is available?

  • FortiCNAPP Cloud-Native Application Protection Platform can help protect and detect related threats using the following services and features:
    How does Lacework FortiCNAPP Protect from... - Fortinet Community

    • Vulnerability Management & SCA: Detects the presence of compromised NPM Packages.

    • SAST: Detects malicious scripts present if compromised NPM packages are downloaded.

    • Runtime Threat Detection: If a compromise occurs, runtime threat detection will detect associated actions with this attack through Composite Alerts.

  • Web Filtering: Blocks access to domains controlled by attackers.

  • Indicators of Compromise (IOCs) Service: FortiGuard Labs has blocked all known linked Indicators of Compromise (IOCs), and the team is continuously monitoring for emerging threats and new IOCs.

  • FortiGuard Antivirus & Behavior Detection: Detects malicious JS/HTML payloads (Shai-Hulud) from poisoned npm packages and advanced behavioral analysis to detect and block unknown threats. Virus | FortiGuard Labs

  • FortiEDR / FortiClient: Detects suspicious script execution and unauthorized Git/token harvesting on endpoints.

  • Organizations suspecting a compromise can contact the FortiGuard Incident Response team for rapid investigation and remediation support.

What is the Attack?

Cisco has disclosed a state-sponsored espionage campaign targeting Cisco Adaptive Security Appliances (ASA) , which are widely deployed for firewall, VPN, and security functions.

  • Initial Advisory (April 24): Attackers exploited two previously unknown zero-day vulnerabilities in ASA devices to infiltrate government entities worldwide.

  • Malware Deployed: The intrusions involved two custom backdoors, “Line Runner” and “Line Dancer” , which worked in tandem to:

    • Alter device configurations

    • Conduct reconnaissance

    • Capture and exfiltrate network traffic

    • Enable potential lateral movement across victim networks

  • Update (September 25, 2025): Cisco observed new malicious activity specifically targeting ASA 5500-X Series appliances. To address this, it released patches for three newly assigned vulnerabilities:

    • CVE-2025-20333

    • CVE-2025-20362

    • CVE-2025-20363

This campaign highlights a sustained effort by sophisticated adversaries to weaponize zero-day flaws in widely deployed Cisco security appliances, with the goal of espionage and long-term persistence.

What is the recommended Mitigation?

What FortiGuard Coverage is available?

  • FortiGuard Web Filtering Service protects against malicious URLs, domains, IPs, and other attacker-controlled infrastructure associated with this campaign, as identified in Cisco’s advisory.

  • FortiAnalyzer, FortiSIEM, and FortiSOAR leverage known Indicators of Compromise (IoCs) delivered through the Indicators of Compromise (IoC) Service to enhance threat hunting, detection, and automated response- strengthening investigation workflows and correlation against related threat activity. FortiGuard Labs continues to monitor for newly emerging IoCs to ensure proactive protection.

  • Meanwhile, FortiGuard Labs strongly recommends users apply patches as provided by Cisco's Product Security Incident Response Team (PSIRT).

  • Organizations suspecting a compromise can contact the FortiGuard Incident Response team for rapid investigation and remediation support.

What is the EDR‑Freeze?

EDR‑Freeze is a proof‑of‑concept technique that leverages legitimate Windows Error Reporting (WER) components to suspend (place into a ‘frozen’ state) endpoint protection processes from user mode. Instead of exploiting drivers or kernel vulnerabilities, EDR‑Freeze abuses trusted OS services and relies on race conditions and process interaction to temporarily pause security products.

This Threat Signal highlights the risk that OS-provided mechanisms can be repurposed against defenders and recommends mitigations and detection guidance for defenders to reduce the technique’s effectiveness.

Impact:
- Opportunity for short-lived actions: adversaries could use the frozen interval to perform small actions (file tampering, process injection, lateral movement steps) that complete within the freeze window.
- Limited persistence: because this approach is time‑bound and unreliable, it is primarily useful for opportunistic or nuisance disruption rather than reliable long‑term evasion.
- Temporary loss of protection telemetry: while a process is frozen, the agent may not report telemetry, receive policy updates, or block malicious activity.

Risk increases when:
- Endpoint agents lack anti‑tampering or watchdog mechanisms.
- Agents run with insufficient process isolation or rely on a single process for core defenses.
- Systems are highly automated and assume uninterrupted agent telemetry for gating actions.

What is the recommended Mitigation?

  • Any Windows endpoint protection product that runs user‑mode agent processes and interacts with Windows Error Reporting (WER) or crash handling subsystems could be a candidate for this technique in theory.

  • No specific vendor or product has been named in the PoC; organizations should treat this as a technique class rather than a single‑product vulnerability.

  • Harden watchdogs, monitor for unusual dump activity, audit suspension events, stay patched, and test PoCs responsibly in isolated environments.

  • Ensure endpoint products are running the latest vendor releases and have anti‑tampering, protection, and watchdog features enabled.

  • Restrict which accounts and processes can interact with WER and crash‑handling flows where feasible (via local policy and application control).

What FortiGuard Coverage is available?

  • Internal validation and testing confirmed that FortiEndpoint’s advanced anti-tampering controls successfully blocked all attempted process suspension attempts associated with the EDR-Freeze technique. During controlled simulations, no disruption to protection telemetry, policy enforcement, or real-time detection was observed. FortiEndpoint’s self-protection modules immediately detected the unauthorized suspension attempt, triggered internal remediation routines, and restored any affected components- maintaining full operational protection throughout the test.

  • FortiEndpoint’s unified agent architecture, combined with multi-layered defense mechanisms (including watchdog services, integrity verification, and process isolation), is specifically designed to resist user-mode and race-condition-based evasion techniques. These capabilities ensure that even if attackers attempt to exploit trusted Windows components, the endpoint remains resilient and continues to enforce security policy without interruption.

  • As part of the Fortinet Security Fabric, FortiEndpoint continuously shares telemetry and threat intelligence with other Fortinet solutions. This integration provides end-to-end visibility across endpoints, networks, and the cloud- enabling coordinated detection, automated response, and adaptive protection against emerging techniques like EDR-Freeze.

Today, the United States Cybersecurity and Infrastructure Security Agency (CISA), in conjunction with the Department of the Treasury (TREASURY), the Federal Bureau of Investigation (FBI), and U.S. Cyber Command (USCYBERCOM) released a joint Technical Alert that have attributed malicious cyber activity to the North Korean government.

The Technical Alert provides detailed analysis of North Korean government activity in an automated teller machine (ATM) cash-out scheme-referred to by the U.S. Government as "FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks." "BeagleBoyz" is a newly identified group that is a subset of activity by the threat actors known as HIDDEN COBRA/LAZARUS/APT 38. In addition to the release of the joint Technical Alert, three Malware Analysis Reports (MAR) were released as well and they are:


MAR-10301706.-1.v1 - 4 samples (ECCENTRICBANDWAGON)

MAR-10301706.-2..v1 - 6 samples (VIVACIOUSGIFT)

MAR-10257062.-1.v2 - 3 samples (FASTCASH)


Why is Hidden Cobra Significant? Also, is this Hidden Cobra Renamed?

HIDDEN COBRA has been linked to multiple high-profile, financially-motivated attacks in various parts of the world - some of which have caused massive infrastructure disruptions. Notable attacks include the 2014 attack on a major entertainment company and a 2016 Bangladeshi financial institution heist that almost netted nearly $1 Billion (USD) for the attackers. Had it not been for a misspelling in an instruction that caused a bank to flag and block thirty transactions, HIDDEN COBRA would have pulled off a heist unlike any other. Although HIDDEN COBRA failed in their attempt, they were still able to net around 81 million dollars in total.

The most recent and most notable attack attributed to HIDDEN COBRA was the Wannacry Ransomware attack, which resulted in massive disruption and damage worldwide to numerous organizations, especially manufacturers. Various estimates of the impact were in the hundreds of millions of dollars, with some estimates claiming billions. Other verticals which this group has targeted include critical infrastructures, entertainment, finance, healthcare, and telecommunication sectors across multiple countries.

According to the Technical Alert, the BeagleBoyz are now attributed by the United States government as being behind the $81 million heist from the financial institution in Bangladesh; whereas past reports linked it to HIDDEN COBRA/LAZARUS activity.


What is the Severity of Impact?

The severity should be regarded as MEDIUM, due to the fact that these campaigns have been observed in limited to targeted attacks.


It Appears that Some Malware Variants have Been Reported Before. Is this Correct?

Yes. Some of the malware variants in this report, such as CROWDEDFLOUNDER, HOPLIGHT, and ELECTRICFISH were previously reported back in February of this year, as well as in 2019.


What is the status of AV/IPS and Web Filtering coverage?

FortiGuard Labs deployed coverage to ensure protections were in place immediately after the announcement by the United States Cybersecurity and Infrastructure Security Agency (CISA). CISA in coordination with the Cyber Threat Alliance (CTA), shared the samples ahead of the announcement with CTA partners to ensure that customers of CTA members were immediately protected.

Customers running the latest definition sets are protected by the following (AV) signatures:

W32/Alreay.BG!tr

W32/KeyLogger.BHFC!tr

W32/Banker.ADRO!tr.spy

W32/Alreay.A!tr

W32/Agent.0D36!tr

W64/Agent.AP!tr

W32/Generic!tr

W64/Banker.AX!tr.spy

W32/Banker.ADRO!tr.bdr

W64/Agent.AP!tr

W32/Alreay.BB!tr


Customers running the latest definition sets are protected by the following (IPS) signatures:

ElectricFish.Tunneling.Tool

What is the Vulnerability?

High-severity vulnerabilities in runc (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) were disclosed in early November 2025. A malicious or compromised container image can abuse how runc handles masked paths, bind-mounts, and special files to write to the host /proc filesystem and escape the container boundary - enabling remote code execution on the host, persistence, or cluster-wide denial-of-service. These issues affect virtually all Linux container stacks that use runc (Docker, containerd, CRI-O, Kubernetes, and managed services)

CVE-2025-31133 - Incorrect handling of masked paths; attacker can replace container /dev/null with a symlink and possibly escape.
CVE-2025-52565 - Incorrect handling of /dev/console bind-mounts; attacker can exploit build-mount symlink to escape.
CVE-2025-52881 - Incomplete fix for earlier CVE-2019-16884 leading to possible DoS or escape.

What is the recommended Mitigation?

Patch runc/update node images: Apply vendor runc updates. AWS lists patched runc (package version runc-1.3.2-2 for Amazon Linux variants) and updated AMIs/Bottlerocket releases; AWS also automated Fargate/ECS updates where applicable. If using other distros, install the distribution-provided patched runc packages per vendor guidance.

Audit & logging: Enable container runtime logs, containerd/dockerd debug for suspicious mount/bind events.

What FortiGuard Coverage is available?

  • FortiGuard Labs continues to monitor this vulnerability and associated exploit activity closely. Users are strongly advised to follow security best practices and apply the latest vendor patches immediately. FortiGuard Labs will update this Threat Signal with additional protective coverage and threat intelligence as the situation evolves.

  • FortiGuard Endpoint Vulnerability Service provides a systematic and automated method of patching applications on an endpoint, eliminating manual processes while reducing the attack surface. Endpoint Vulnerability | FortiGuard Labs

  • FortiCNAPP Cloud Team is actively investigating the impact on cloud workloads and will provide configuration and remediation guidance as new information becomes available. How Lacework FortiCNAPP protects from ... - Fortinet Community

  • Incident Response Support: The FortiGuard Incident Response team is available to assist organizations with investigation, containment, and recovery in the event of suspected compromise.

What is the Vulnerability?

A critical Out-of-Bounds Write vulnerability (CVE-2025-9242) exists in the WatchGuard Fireware OS iked process, which handles IKEv2 VPN connections. The flaw allows a remote, unauthenticated attacker to execute arbitrary code on affected devices.

The vulnerability impacts both:
- Mobile user VPNs using IKEv2, and
- Branch Office VPNs using IKEv2 when configured with a dynamic gateway peer.

WatchGuard has confirmed the issue is resolved in patched releases and has reported evidence of active exploitation in the wild. Additionally, public technical analysis and proof-of-concept reproduction of the flaw are available, increasing the likelihood of broader attacks.

What is the recommended Mitigation?

  • Install vendor patches on all affected Firebox appliances.

  • Rotate all locally stored secrets on vulnerable appliances (WatchGuard recommends rotating secrets due to evidence of exploitation) - passwords, shared keys, certificates stored on the Firebox,

What FortiGuard Coverage is available?

  • Intrusion Prevention System (IPS): FortiGuard IPS Service is available to detect and block exploit attempts targeting CVE-2025-9242. Intrusion Prevention | FortiGuard Labs

  • Incident Response Service: The FortiGuard Incident Response team is available to assist with any suspected compromise.

What is the Vulnerability?

CVE-2025-59287 is a critical unauthenticated remote code execution (RCE) vulnerability affecting Windows Server Update Services (WSUS). The flaw stems from unsafe deserialization of untrusted data, allowing attackers to execute arbitrary code on vulnerable servers without authentication.

A public proof-of-concept exploit has been released, and CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, emphasizing active exploitation in the wild.

Organizations should prioritize immediate patching or isolation of any internet-facing or exposed WSUS servers to prevent compromise.

What is the recommended Mitigation?

The vulnerability impacts Windows Server installations with the WSUS role enabled, including Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025.

  • Apply Microsoft’s out-of-band security update released on October 23, 2025 (referenced in Microsoft’s official advisory and KB documentation).

  • Restrict network access to WSUS servers, ensuring they are not exposed to untrusted or external networks.

  • Review system logs for unusual activity or unauthorized WSUS access attempts.

What FortiGuard Coverage is available?

  • FortiGuard IPS Service detects and blocks exploit attempts targeting CVE-2025-59287. Intrusion Prevention | FortiGuard Labs

  • FortiGuard Endpoint Vulnerability Service provides a systematic and automated method of patching applications on an endpoint, eliminating manual processes while reducing the attack surface. Endpoint Vulnerability | FortiGuard Labs

  • The FortiGuard Incident Response team can be engaged to help with any suspected compromise.

طراحی سایت : رادکام