Mandiant Fortinet Zero Day

CASTLETAP can execute a C2 command to transfer files from victim machines.

UNC3886 has established remote SSH access to targeted ESXi hosts.

UNC3886 has named a file ‘fgfm’ in an attempt to disguise it as the legitimate service ‘fgfmd’ which facilitates communication between FortiManager and the FortiGate firewall.

UNC3886 has attempted to bypass digital signature verification checks at startup by adding a command to the startup config `/etc/init.d/localnet` within the rootfs.gz archive of both FortiManager and FortiAnalyzer devices.

CASTLETAP has the ability to create a raw promiscuous socket to sniff network traffic.

CASTLETAP has the ability to spawn BusyBox command shell in victim environments.

THINCRUST can use Python scripts for command execution.

UNC3886 has used the the esxcli command line to remove files created by malicious vSphere Installation Bundles from disk.

UNC3886 has cleared specific events that contained the threat actor’s IP address from multiple log sources.

THINCRUST can use HTTP POST requests in C2 communications.

UNC3886 has deployed backdoors that communicate over TCP to compromised network devices and over VMCI to ESXi hosts.

REPTILE can communicate using TLS over raw TCP.

CASTLETAP can transfer files to compromised network devices.

CASTLETAP can filter and deobfuscate an XOR encrypted activation string in the payload of an ICMP echo request.

THINCRUST can deobfuscate RSA encrypted C2 commands received through the DEVICEID cookie.

UNC3886 has exploited CVE-2022-42475 in FortiOS SSL VPNs to obtain access.

The REPTILE reverse shell component can listen for a specialized packet in TCP, UDP, or ICMP for activation.

UNC3886 has used the TABLEFLIP traffic redirection utility to listen for specialized command packets on compromised FortiManager devices.

UNC3886 maintained persistence on FortiGate Firewalls through ICMP port knocking.

CASTLETAP can listen for a specialized ICMP packet for activation on compromised network devices.

UNC3886 has used vSphere Installation Bundles (VIBs) to install malware and establish persistence across ESXi hypervisors.

UNC3886 has trojanized Fortinet firmware and replaced the legitimate `/usr/bin/tac_plus` TACACS+ daemon for Linux with a malicious version containing credential logging functionality.

UNC3886 modified the startup file `/etc/init.d/localnet` to execute the line `nohup /bin/support &` so the script would run when the system was rebooted.

THINCRUST can process RSA encryted C2 commands.

CASTLETAP can receive a 9-byte XOR encrypted activation string in the payload of an ICMP echo request packet.

CASTLETAP can initiate a C2 connection over an SSL socket.

REPTILE can use TLS over raw TCP for secure C2.

UNC3886 has deployed custom malware families on Fortinet and VMware systems.

UNC3886 has used zero-day vulnerabilities CVE-2022-41328 against FortiOS and CVE-2023-20867 and CVE-2023-34048 against VMware vCenter.

UNC3886 used `vmtoolsd.exe` to run commands on guest virtual machines from a compromised ESXi host.

UNC3886 has disabled OpenSSL digital signature verification of system files through corruption of boot files.

THINCRUST can use the Django python module "django.views.decorators.csrf” along with the decorator “csrf_exempt” within victim firewalls to disable cross-site request forgery protections.

UNC3886 has used the TABLEFLIP traffic redirection utility and the esxcli command line to modify firewall rules.