Cybersecurity researchers at Group-IB and NyxLab have published a joint investigation into a large-scale campaign targeting exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. The activity has been attributed to a threat actor tracked as k0t, who also uses the aliases CryptoFeel, Member19 and QazWsxShop.
The researchers said artifacts from their investigation indicate operators in the campaign obtained access to numerous organizations worldwide and attempted to further compromise some victims, resulting in persistent remote access and data exfiltration. More than 70,000 exposed credentials tied to network devices and LDAP dumps have been identified in connection with the activity.
According to the report, k0t selects targets by enumerating exposed network appliances at scale rather than researching individual organizations. "His stated geographic priorities begin with the United States and Canada, followed by European countries and selected APAC markets," the researchers said, adding that the product and location of an exposed device appear to matter more than the industry operating it.
Nearly 38% of victims are concentrated in Asia Pacific, followed by 31.9% in Latin America, 15.8% in Europe and 12.7% in the Middle East and North Africa. Many victims were later listed by the ransomware groups Qilin and The Gentlemen on their data leak sites, though the researchers said the exact nature of the connection is unclear.
The attack chain, as described in the report, runs from reconnaissance through public scanning tools such as FOFA and ZoomEye to exploitation of known vulnerabilities and brute-force attempts, followed by an OpenConnect VPN foothold. Post-exploitation includes enumeration of Active Directory, SMB and installed antivirus, persistence via remote access tools including MeshCentral Agent, Atera, Teramind and AnyDesk, and exfiltration using Rclone into Wasabi S3 buckets and MEGA cloud drives.
The researchers also flagged a "negligible overlap" in compromised data between this activity and FortiBleed, a separate credential harvesting campaign. They advised organizations to ensure any vulnerabilities mentioned in the report are appropriately remedied.
Source: The Hackers News