Loading story…
A suspected China-linked threat actor exploited CVE-2022-42475, a heap-based buffer overflow in Fortinet FortiOS SSL-VPN, as a zero-day to compromise internet-facing FortiGate devices in espionage operations. Reporting tied the activity to intrusions at a European government entity and an Africa-based managed service provider, with telemetry indicating exploitation began in October 2022, nearly two months before Fortinet released patches.
The attackers deployed a custom backdoor named BOLDMOVE, including a Linux variant designed specifically for FortiGate firewalls. Investigators said the malware could tamper with device logging to reduce visibility and help the operators evade detection, and assessed the tradecraft as consistent with prior Chinese campaigns targeting perimeter security infrastructure such as firewalls and IDS/IPS appliances for long-term intelligence collection.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Mandiant telemetry indicated a suspected China-nexus threat actor was exploiting the FortiOS SSL-VPN vulnerability CVE-2022-42475 as early as October 2022. The espionage activity targeted at least a European government entity and an Africa-based managed service provider.
Metadata analysis cited by Mandiant showed Windows variants of the BOLDMOVE backdoor were compiled as early as 2021. The report noted no Windows BOLDMOVE samples were detected in the wild.
Mandiant reported that the zero-day exploitation involved deployment of the custom BOLDMOVE backdoor, including a Linux variant tailored for Fortinet FortiGate firewalls and designed to manipulate logging for evasion. The company assessed the tradecraft as consistent with prior Chinese espionage operations targeting internet-facing security devices.
Fortinet previously disclosed that unknown hacking groups had exploited CVE-2022-42475 to target governments and other large organizations. Fortinet said the attackers used a generic Linux implant capable of delivering additional payloads and executing remote commands.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FBI and CISA warned that APT actors were actively scanning internet-facing Fortinet devices and exploiting multiple FortiOS vulnerabilities, including **`CVE-2018-13379`**, **`CVE-2020-12812`**, and **`CVE-2019-5591`**, to gain initial access and maintain a foothold for follow-on attacks. The agencies said the activity affected government, commercial, technology, and critical infrastructure organizations, with scanning observed on ports **4443**, **8443**, and **10443**. In one cited case, an APT group almost certainly exploited a FortiGate appliance to access a web server hosting a U.S. municipal government domain and likely created the username **`elie`** on the network. The campaign built on long-running exploitation of Fortinet SSL VPN weaknesses, especially the path traversal flaw **`CVE-2018-13379`**, which had already enabled the leak of credential-bearing session files from nearly **50,000** vulnerable devices worldwide. Those exposed **`sslvpn_websession`** files contained plaintext usernames and passwords, allowing attackers to reuse credentials even after patching. U.S. authorities said compromised access could support data exfiltration, ransomware-style encryption, and other post-exploitation activity, and highlighted indicators including FRP tunneling tools, unusual FTP traffic over port **443**, and a scheduled task named **`SynchronizeTimeZone`**.
Aug 15, 2026
A large-scale credential-harvesting campaign has compromised more than **30,000 Fortinet FortiGate firewalls and VPN gateways** across **194 countries**, according to SOCRadar, which said the attackers amassed a database of **30,791 verified working credentials**. Researchers said the operation targeted internet-facing Fortinet management and VPN interfaces using **credential stuffing, password spraying, brute-force attempts, and reused passwords from prior leaks**, and found **no evidence of a Fortinet zero-day or a breach of Fortinet itself**. The attackers allegedly used compromised devices as listening posts to capture additional credentials and feed them into an automated attack chain, broadening access across sectors including **telecommunications, government, healthcare, finance, education, energy, and other critical infrastructure**. Telecom was reported as the most affected sector, while government entities accounted for **591 entries across 111 domains**; **India and the United States** represented nearly one-third of identified compromises. SOCRadar said the campaign remained active and assessed it as **critical**, with tooling and victim selection described as consistent with **Russian-speaking threat actors** and possible motives spanning both **financial gain and cyberespionage**.
Jul 23, 2026
Researchers reported a China-linked espionage campaign targeting enterprise edge routers in Southeast Asia with a custom Linux implant called `router.elf`. The malware uses encrypted HTTPS command-and-control over port 443 and Cloudflare DNS over HTTPS to conceal communications, while modifying `iptables` NAT rules to redirect downstream DNS traffic to attacker-controlled resolvers. Analysts said this gives the operators an infrastructure-level foothold for surveillance, traffic interception, and possible manipulation of internal network activity, including software update flows. The operation also appears to extend from compromised routers into Windows environments. Investigators linked the Linux activity to a secondary backdoor, `client_rc_start`, and to a Windows intrusion chain that deploys a Cobalt Strike Beacon through DLL sideloading, using a malicious `version.dll` loaded by `CrashReport.exe`. Shared command-and-control domains, URI patterns, cookie markers, user-agent values, and beacon timing indicate centralized control across the Linux and Windows components, while attribution clues cited in reporting include Mandarin-language strings, a `zh-CN` setting, and tooling overlaps with earlier China-linked operations.
Jun 29, 2026