Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Initial Access Broker. Show all posts
VPN Credential Theft
credential harvesting Cyber Threats enterprise cybersecurity FortiBleed Campaign FortiGate Firewall Security FortigateSniffer Initial Access Broker Network Security Breach VPN Credential Theft

FortigateSniffer Malware Harvests User Credentials From Infected Firewalls


The perimeter firewall has been used as a primary line of defense against external intrusions for years, but the newly uncovered campaign illustrates how these same security appliances can be weaponized against the organizations they are intended to safeguard. 

Researchers have discovered a large-scale attack involving a custom Golang-based tool known as FortigateSniffer that has been deployed systematically on compromised FortiGate firewalls since February 2026. Over 430,000 internet-facing devices have been impacted by the campaign, which is linked to an initial access broker (IAB) believed to be operating as a financial motivation threat actor. 

Over 110 million credentials have been collected under covert measures by the attackers. As trusted network gateways were transformed into silent credential-harvesting platforms, the operation illustrates one of the most significant paradigm shifts in attacker tradecraft, where compromised security infrastructures themselves serve as sources of intelligence and access. 

The scale, persistence, and operational sophistication observed throughout the campaign-tracked as FortiBleed-have raised concerns across the cybersecurity community. Particularly after evidence of the exfiltration of sensitive data by a NATO-aligned defense contractor, as well as the potential use of stolen credentials for ransomware, espionage, and post-compromise activities, are emerging. 

It is evident from a further analysis of the operation that it extends well beyond credential theft from FortiGate appliances, and demonstrates a highly automated initial-access ecosystem that can be scaled across multiple technological platforms.

CyberStrike, an open-source, artificial intelligence-native offensive security framework, could have been utilized by the threat actors to streamline portions of the attack workflow, emphasizing how automation has become increasingly important in large-scale intrusion campaigns. As part of the activity, a substantial emphasis was placed on small and medium-sized businesses, especially companies with fewer than 200 employees, with the United States and India emerging as the most heavily targeted regions. 

The potential for IT service providers to serve as entry points into broader customer networks likely prompted particular attention for them. Moreover, researchers observed parallel brute-force attacks on NAS systems, firewalls from Sophos, portals for RDWeb, SSL VPN gateways for Citrix, and Microsoft SQL servers, which suggests that the campaign was designed to acquire access opportunities across diverse enterprise environments. 

On May 31 and June 15, 2026 alone, the operators executed at least 659 automated credential-harvesting pipelines, which resulted in the discovery of more than 110 million authentication items. A total of 14.8 million RADIUS credentials were recovered, along with approximately 924,000 NTLM password hashes, 130,000 Kerberos hashes, and approximately 89 million MySQL authentication tokens, indicating the scale of the operation and the significant downstream risks associated with the reuse and monetization of stolen enterprise credentials. 

FortigateSniffer is a purpose-built credential intercept utility that is suited for Linux and Windows environments and was designed to leverage legitimate FortiOS functionality rather than rely on conventional malware. It has been demonstrated that using FortiGate appliances' native packet diagnostic capabilities, researchers are able to passively monitor authentication traffic moving through compromised devices to collect credentials and authentication artifacts across a wide range of enterprise protocols via the tool. 

The captured traffic is then converted into a packet-capture format and processed by a specially designed analysis framework which extracts cleartext usernames, passwords, NTLMv2 hashes, Kerberos tickets, and session cookies in addition to other authentication data. A structured, multi-stage attack chain is employed in the attack chain, beginning with large-scale internet reconnaissance, which involves the use of scanning utilities and customized filtering tools for the detection and categorization of FortiGate systems by location. 

In order to obtain privileged access to administrative interfaces and SSL-VPN services, attackers use credential validation, password spraying, and credential stuffing techniques. Using persistent SSH access, FortigateSniffer harvests authentication data while recovering hashed passwords are transferred to a dedicated cracking platform using distributed processing and automated task orchestration. 

Once successful credentials are recovered, they can be weaponized for lateral movement, Active Directory reconnaissance, Kerberos verification, SMB authentication, and further network expansion, as well as obtaining sensitive information from file shares accessible to the attacker and maintaining authenticated sessions using stolen cookies. 

A number of significant operational security measures, such as geofencing controls and time-based execution windows aligned with standard Moscow business hours, were incorporated to reduce detection risk, which appear highly deliberate, with targets prioritized based on perceived economic value before operational resources are committed. 

Separate telemetry also revealed an automated validation pipeline that is deployed in recurring five-hour cycles with up to 1,000 simultaneous verification threads, leading to exceptionally high early-stage success rates. Researchers also observed identical usernames and passwords recurring across thousands of different IP addresses, a phenomenon that has raised concerns about the possibility of some credentials being strategically seeded for covert re-entry into compromised environments. 

Throughout the course of the investigation, researchers began to gain a deeper understanding of the extent of credential exploitation enabled by the campaign. Analysis showed that once FortiGate appliances were compromised, attackers deployed FortigateSniffer to covertly collect authentication traffic traversing the devices, allowing them to acquire both cleartext credentials and password hashes that were subsequently cracked, validated, and reused against Active Directory environments, VPN gateways, and other externally accessible enterprise services. 

As a result of reviewing intelligence data collected by Hunt Intelligence on June 12, 2026, cybersecurity researcher Volodymyr "Bob" Diachenko identified indicators of this activity, which immediately sparked widespread interest in the operation. Upon examination of the stolen dataset, it was found that credentials were associated with approximately 74,000 firewall URLs covering 194 countries and impacting over 21,000 unique domains. 

In response, data from the incident was shared with national computer emergency response teams to facilitate coordination and dedicated exposure-checking portals were launched to assist organizations in determining whether their Fortinet infrastructure had been compromised. According to researchers, by mid-June, the attackers' database had grown to contain more than 86,000 authenticated and active credentials related to corporate firewalls and VPN services worldwide.

The largest concentration of exposed organizations is found in India and the United States. These findings are of significance not only due to the high volume of compromised accounts, but also due to their validity; investigators noted that the credentials were systematically tested and verified through an automated validation infrastructure rather than speculative password guessing. 

The information gathered from underground marketplaces confirmed suspicions that the campaign is linked to an initial access brokering operation, as the same threat actor previously advertised network access on darknet forums for substantial sums to organizations across a variety of industries, including healthcare, technology, and telecommunications. 

Even though it is not yet confirmed that these sales are directly related to the FortiGate harvesting campaign, the overlap indicates that access being collected has potential commercial value.  In response, Fortinet has initiated outreach to potentially affected customers and advised organizations to immediately terminate active administrative and VPN sessions, rotate credentials, enforcing multifactor authentication, and reviewing logs and configuration changes in detail. It has also encouraged customers to upgrade FortiOS to the latest versions of FortiOS, which are replacing legacy SHA256-based password storage with Password-Based Key Derivation Function 2 (PBKDF2). 

Security teams, however, are cautioned that firmware upgrades alone cannot eliminate this risk, as legacy SHA256 password entries must be manually removed from the system. After modernization efforts have been completed, attackers may still be able to recover administrative passwords through offline cracking techniques if credentials or configuration files were previously exposed, preserving an opportunity for unauthorized access even after modernization efforts have been completed. 

An increasingly common practice in cyber operations is to harvest access information from security infrastructure and gather credential information in large quantities. The FortiBleed campaign highlights this reality. In addition to the immediate impact on affected organizations, the operation illustrates the capability of combining automated tools, credential validation pipelines, and access brokerage activities in a highly efficient ecosystem to prevent downstream intrusions. 

It is important to remind defenders that perimeter devices require the same level of continuous monitoring, credential hygiene, and security review as any other critical asset for a defender. When organizations rely on internet-facing authentication services, this campaign is an excellent opportunity to reevaluate access control measures, identify security weaknesses, and investigate unauthorized activity proactively before harvested credentials are used to compromise a broader organization.
Read more »
Threat Intelligence
Cyber Attacks Endpoint security Initial Access Broker Phishing Attack Ransomware Precursor RMM Exploitation ScreenConnect Threat SimpleHelp Abuse Threat Intelligence

Over 80 Organisations Impacted by Phishing Leveraging SimpleHelp and ScreenConnect

 


Researchers have identified a systematic intrusion operation that is utilizing remote management utilities, and recent findings reinforce this shift in phishing campaigns, which have evolved from opportunistic scams to structured intrusion operations. 

Researchers have identified an ongoing campaign that has compromised more than 80 organizations across multiple industries since April 2025, with a significant concentration in the United States. In the operation, malicious software is deliberately used, allowing attackers to establish covert and persistent access under the guise of legitimate administrative activity through the deliberate use of vendor-signed Remote Monitoring and Management software. 

Through the deployment of modified versions of SimpleHelp and ScreenConnect, the threat actors have effectively bypassed conventional security controls, relying on trusted installation workflows initiated by innocent individuals. 

The activity aligns with previously observed clusters tracked by independent security teams, but this latest analysis provides enhanced insight into the campaign's indicators, behavior, and operational sophistication, highlighting a coordinated effort that is extending its reach in a coordinated fashion. 

Securonix analysis, which tracks the VENOMOUS#HELPER activity cluster, shows that the operation has maintained continuous momentum since April 2025, extending its reach beyond the U.S. into Western Europe and Latin America. 

The campaign is distinguished by its calculated use of two Remote Monitoring and Management platforms, SimpleHelp and ScreenConnect both of which are legitimately signed and widely utilized by enterprises. Rather than deploying conventional malware payloads, threat actors employ these trusted tools to embed persistent access within victim systems, effectively blending malicious activity with routine administrative functions in order to achieve effective results. 

By using two RMM solutions in parallel, there is built-in redundancy, which ensures access continues regardless of whether a channel is detected and removed. Although no formal attribution has been established, Securonix concludes that these operational patterns are consistent with financial motivated Initial Access Brokers and early-stage ransomware campaigns, particularly those targeting organizations in economically significant regions. 

The activity cluster, known as VENOMOUS#HELPER, continues to demonstrate significant overlap with threat patterns previously documented by Red Canary and Sophos, whose designation for it is STAC6405, based on these findings. Although its operational characteristics are consistent with financial-driven initial access brokerage or early-stage ransomware enablement, its attribution remains unclear. 

A researcher involved in the investigation indicates that by deploying SimpleHelp and ScreenConnect in customized configurations, the campaign is able to circumvent conventional defensive mechanisms by embedding itself within legitimate administrative workflows, which allows attackers to bypass conventional defensive mechanisms. 

Additionally, a deliberate dual-channel access strategy is used to strengthen the resilience and continuity of control, even if one access vector is identified and neutralised. The intrusion sequence is initiated through a carefully crafted phishing email impersonating the U.S. Social Security Administration, asking recipients to verify their email address and download a purported statement via an embedded link. 

In an attempt to bypass email filtering systems, the link does not redirect victims to an overtly suspicious infrastructure; instead, it redirects victims to a legitimate Mexican business domain that is compromised, but otherwise legitimate. A disguised executable masquerading as an official document is retrieved from a secondary attacker-controlled domain in order to stage the subsequent payload delivery. 

A compromised cPanel account on a legitimate hosting environment was used to create the infrastructure for this purpose. When the JWrapper-packaged Windows binary is executed, it initiates a sequence aimed at ensuring persistence and stability of the application. Windows services are configured to survive Safe Mode conditions and employ a self-healing watchdog mechanism for automatic restoration of execution if terminated. 

Parallel to periodic reconnaissance, the implant queries the root/SecurityCenter2 WMI namespace to enumerate installed security solutions periodically. It is also configured to poll users on a periodic basis in order to monitor user activity. A combination of these behaviors illustrates a high level of technical maturity that is intended to maintain low-visibility access within compromised environments over long periods of time. 

STAC6405 infection chain reveals a methodical, multi-stage delivery framework designed to delay suspicion until execution has been established firmly on the victim computer. In the first stage, the intrusion begins with phishing emails impersonating the U.S. Social Security Administration, informing recipients of the recently released statement and requesting immediate action. 

In place of utilizing attacker-registered infrastructure, the embedded link redirects to a compromised but legitimate Mexican domain, a method designed to circumvent Secure Email Gateway filtering by utilizing the inherent trust that is associated with established .com.mx domains. Users are required to confirm their email addresses on the landing page to proceed with the SSA verification interface. This intermediate harvesting step not only validates the target’s authenticity but also provides attackers with an established communication channel to target them in the future. 

In response to this interaction, victims are seamlessly redirected to an attacker-controlled secondary host where a payload is staged for download. Based on the delivery URL structure, it appears to have been a compromise of a single cPanel account in a shared hosting environment, as indicated by the tilde-prefixed directory names. This report emphasizes the fact that the primary website infrastructure remains intact, with malicious content confined to a subdirectory deliberately named to maintain thematic consistency with the lure involving Social Security. 

To conceal the binary's true nature, the final payload, which is distributed as a Windows executable, takes advantage of default operating system behavior. File extensions are hidden in Explorer, which makes the binary appear legitimate, while JWrapper packaging incorporates customised visual elements such as iconography and splash screens to reinforce the authenticity of the binary. 

At each stage of execution, STAC6405 prioritizes credibility, evasion, and user manipulation in an effort to convey a carefully orchestrated delivery mechanism. The foundation of STAC6405's effectiveness lies in the use of calculated methods to exploit implicit trust in remote administration programs.

In addition, both SimpleHelp and ScreenConnect binaries are signed with Authenticode certificates, issued by globally recognized certificate authorities, which enables them to pass signature-based security checks seamlessly. These binaries are not flagged by traditional antivirus controls, Windows SmartScreen and Mark-of-the-Web protections are effectively neutralized, and endpoint detection mechanisms are forced to make use of behavioral telemetry, such as process lineage, rather than static indicators, such as file hashes, to detect endpoints. 

A network perspective indicates that outbound traffic is blending with legitimate activity by communicating with infrastructure that appears consistent with commercial software usage rather than overt command-and-control mechanisms. A cracked distribution of SimpleHelp, version 5.0.1 compiled in July 2017, aligns with the instance deployed in this campaign, which was widely circulated in underground forums between 2016 and 2019. 

Due to its expiring certificate window and lack of license validation mechanisms, it is highly likely that the tool has been deployed without financial traceability or vendor oversight by threat actors. The foundation supports a dual-RMM architecture that is purposefully engineered to fulfill distinct operational roles while bolstering the persistence of the other tools. 

The SimpleHelp application primarily utilizes UDP and HTTP communications over port 5555 to connect directly to an IP-based command endpoint for automated surveillance, scripted execution, and low visibility control. By contrast, ScreenConnect facilitates interactive, hands-on keyboard access over TCP port 8041 by using a proprietary relay protocol whose domain is controlled by an attacker. 

By separating these channels, not only is operational flexibility enhanced, but a resilient environment is created which ensures that disruption of one channel does not lead to the complete loss of access to the attacker. 

Remote administration capabilities are available through the SimpleHelp deployment, which includes full desktop control through VNC-based interaction, command execution by a virtual terminal bridge, silent session establishment without notification of the user, and privilege escalation mechanisms that bypass conventional user account control prompts. 

A number of additional features further reinforce persistence, including bidirectional file transfer, automated firewall rule modification, remote scripting, and self-healing service restoration. Cross-platform binaries are also indicative of adaptability, as they indicate that the same toolkit can be used on macOS and Linux systems as well, thereby expanding the potential attack surface and maintaining the same operational footprint across the same platforms. 

VENOMOUS#HELPER illustrates a measured shift in adversary tradecraft where stealth, legitimacy, and operational resilience are given greater priority than traditional malware deployments. By integrating themselves within trusted administrative ecosystems and utilizing a dual-RMM framework, operators dissolve the distinction between benign and malicious activity, creating a complex detection and response process. 

There was an intentional effort to circumvent conventional controls at every stage of the intrusion life cycle by means of the campaign's structured delivery chain, abuse of compromised infrastructure, and use of signed binaries. Therefore, defensive strategies based solely on signature detection or known indicators fail to be sufficient in this context.

Organisations, therefore, must reevaluate their security posture toward behavioural analysis, tight control over remote access tools, and continuous monitoring of the relationships between processes and the use of privileges. As threat actors refine these techniques, the campaign is a clear indicator that trusted software is becoming increasingly effective for executing untrusted intent in the cyberspace.
Read more »
Strela Stealer Campaign
Detour Dog Threat Actor DNS Command And Control DNS Security Monitoring DNS TXT Record Exploit Initial Access Broker malware Strela Stealer Campaign

The Growing Threat of DNS Powered Email and Web Attacks


 

As an important component of the internet architecture, the Domain Name System has historically played the role of an invisible intermediary converting human intent into machine-readable destinations without much scrutiny or suspicion. However, this quiet confidence has now been put to the test. 

Research conducted by DomainTools has revealed a subtle yet consequential technique that redefines DNS into a covert delivery channel for malicious code rather than just a directory service. Rather than hosting payloads on compromised servers or suspicious domains, attackers fragment malware into tiny segments and embed them in DNS TXT records scattered across a variety of subdomains.

The fragments appear harmless when isolated, indistinguishable from legitimate configuration information. However, after systematically querying and reassembling-often by scripting PowerShell commands-the pieces combine to form fully functional malware. As a result of the implicit trust placed in DNS traffic and the limited visibility many organizations maintain over it, this methodical approach is inexpensive, methodical, and quiet. 

According to a report by Ars Technica, DNS infrastructure abuse is not merely theoretical. Threat actors have operationalized the technique in a manner that has been remarkable in its precision. In that instance, the malicious payload was converted into hexadecimal form and separated into hundreds of discrete chunks. As a result of the registration of whitetreecollective.com and generation of a large number of subdomains, the operators assigned each fragment to a distinct TXT record of the host. 

These records, individually, appeared to be indistinguishable from routine DNS metadata which is commonly used for verifying domains, authenticating email, and establishing service configurations. Collectively, however, they constitute a malware repository incorporated into the DNS infrastructure as a whole. Upon establishing foothold access inside a target environment, the reconstruction process did not require any more conspicuous methods than a series of DNS queries. 

Each encoded fragment was retrieved individually using scripted queries, which allowed the payload to be assembled in memory without the need for conventional file downloads or suspicious HTTP traffic. This retrieval mechanism blends seamlessly into ordinary network activity since DNS requests are ubiquitous and rarely subject to deep inspection, particularly in environments requiring encrypted resolvers. 

Even though DNS tunneling has long been associated with data exfiltration and command-and-control communications, the deliberate hosting of malicious payloads across TXT records represents a more assertive evolution in this area. 

Through the campaign, people illustrate the importance of comprehensive DNS telemetry, anomaly detection, and policy enforcement within modern enterprise security architectures, and demonstrate how foundational internet protocols, when inadequately monitored, can be repurposed into resilient delivery channels. 

Furthermore, investigations into DNS-enabled threat infrastructure revealed the activities of a threat actor identified as Detour Dog, who was the key enabler for campaigns to distribute the Strela Stealer malware. In accordance with Infoblox analysis, the actor is in control of domains hosting the initial malware component a lightweight backdoor called StarFish that is used to deliver the malware chain. 

During the first stage, the implant functions as a reverse shell, establishing a persistent communication channel that facilitates retrieving and executing the Strela Stealer payload. Informationblox has been tracking Detour Dog since August 2023, when Sucuri, a company owned by GoDaddy, reported security breaches targeting WordPress sites. 

Early operations involved the injection of malicious JavaScript into compromised websites to serve as covert command channels for traffic distribution systems using DNS TXT records. Visitors were silently directed to malicious sites or fraudulent pages.

Historical telemetry indicates a sustained and evolving presence of the actor since February 2020, suggesting that its infrastructure extends back as far as February 2020. Operational model has since matured. Where redirects once supported scams, DNS-based command-and-control frameworks now permit staged execution of remote payloads. 

According to IBM X-Force, StarFish is delivered through weaponized SVG files, enabling persistent attacks and hands-on access to compromised systems. A financially motivated operator has been identified as Hive0145 since at least 2022 as the sole operator responsible for the Strala Stealer, a criminal operation that has been functioning as an initial access broker monetizing unauthorized access to networks by reselling them to other criminals. 

Further, Detour Dog's DNS infrastructure was found to play a major role in 69 percent of confirmed StarFish staging hosts, highlighting its central role in the broader campaign. Additionally, the attack chain included a MikroTik-based botnet, marketed as REM Proxy, which was armed with SystemBC malware previously analyzed by Black Lotus Labs at Lumen Technologies. 

In addition to REM Proxy, Tofsee botnet, which historically propagated through PrivateLoader C++ loader, was also responsible for spam emails that delivered Strela Stealer. Detour Dog's infrastructure consistently hosted the first-stage payload on both distribution pathways, confirming the actor's role as a crucial DNS-centric facilitator within Strela's ecosystem.

When Detour Dog first emerged as a threat intelligence source, its activities seemed relatively simple. The primary use of compromised websites was to redirect visitors to fraudulent advertising networks, scam websites, and deceptive CAPTCHA pages that are intended to generate illegal revenue through forced clicks. However, telemetry indicated a strategic shift by late 2024. 

Initially, the infrastructure served as a traffic monetization strategy, but it soon became a distribution backbone for materially more dangerous payloads. A DNS-centric framework was observed to facilitate the delivery of Strela Stealer, a family of malware that steals information associated with the threat actor Hive0145, in mid-2025. 

The Strela campaigns, usually initiated through malicious email attachments themed around invoices, are intended to exfiltrate user credentials, session information, and host information stored in browsers. There is no indication that Detour Dog directly hosts final-stage malware binaries.

In reality, it appears to operate as a DNS relay layer, resolving staged instructions and retrieving remote payloads from attacker-controlled servers before relaying them through compromised web assets. Indirection obscures the true origin of malware and complicates the static blocking process. A detailed description of Detour Dog's operation remains unclear. It is unclear whether it functions solely as an infrastructure provider or concurrently runs its own campaigns. 

According to an analysis of infrastructure overlap and domain control, Detour Dog has provided DNS channels to other operators, including Hive0145, for distribution of payloads. According to internal research, nearly two-thirds of the staging domains associated with recent campaigns are controlled by Detour Dog, suggesting a delivery-for-hire model as opposed to a single threat operation whose focus is on a single, isolated threat. 

The primary entry point into the ecosystem continues to be email. Malicious attachments often masquerade as invoices or business documents and initiate a multi-stage infection process. This documentation does not embed the final payload in its entirety, but instead refers to compromised domains that query Detour Dog's name servers for further instructions.

By using DNS lookups as a precursor to remote execution, ostensibly benign clicks can be transformed into covert downloads and staging sequences as a result of a server-side retrieval process. Mass distribution has been linked to botnets such as REM Proxy, a MikroTik-based network, and Tofsee, while Detour Dog provides persistent hosting and DNS command and control relays to protect backend infrastructure against direct exposure. 

The segmentation of responsibilities reflects the increasingly modular nature of cybercriminals' supply chains. Among the groups, one manages spam dissemination, another provides DNS and hosting infrastructure resilience, and a third develops and operates the information-stealing payload. Such compartmentalization makes attribution and disruption difficult. 

A single component rarely dismantles an operation; actors can reconstitute infrastructure or redirect traffic in a matter of seconds if a single component is removed. As such, defensive strategies must include DNS-layer intelligence capable of detecting anomalous TXT record queries as well as covert command channels prior to downstream payload execution.

The example of Detour Dog demonstrates how foundational internet protocols can be used to deliver stealth payloads. It has been observed that threat actors embed malicious orchestration in routine DNS activity to transform everyday web traffic into an unobtrusive mechanism to deliver malware and exfiltrate data. 

As part of the prevention of this class of threat, organizations should elevate DNS from a background utility to a frontline security control by integrating visibility, validation, and enforcement across both email and resolution layers. There are wider implications for security leaders than just a single campaign or actor. 

Adversaries have begun weaponizing core internet infrastructure in a structural way by combining email lures, DNS staging, and modular malware services. Defense systems based primarily on perimeter filtering and endpoint detection are unlikely to identify threats that arise through routine name resolution. 

In order to maintain DNS observability, organizations must implement a strategy that correlates resolver telemetry with email security signals, enforces strict egress policies, verifies record integrity, and integrates threat intelligence into recursive as well as authoritative layers. 

DNS configuration auditing, anomaly detection of irregular TXT record patterns, and rigorous segmentation of web-facing assets are three effective ways to reduce exposure. As adversaries continue to operationalize trusted protocols for covert delivery, resilience will increasingly rely on disciplined architectural design that treats DNS as a decisive defense line rather than a background infrastructure.
Read more »
Subscribe to: Posts (Atom)