A zero-day in Fortinet's Windows VPN client, FortiClient, is being compromised by Chinese state-affiliated threat actors.
BrazenBamboo, as the group is known, uses its DEEPDATA malware - a "modular post-exploitation tool for the Windows operating system" - that extract credentials from, in this case, FortiClient VPN client process memory.
"This vulnerability was discovered while analyzing a recent sample of the DEEPDATA malware family," wrote cyber security firm, Volexity, in a report outlining BrazenBamboo's "abuse" of the vulnerability.
The vulnerability was first noticed by Washington DC-based Volexity in mid-2024. On July 18, researchers at the firm alerted Fortinet to the vulnerability in question.
"Fortinet acknowledged the issue on July 24, 2024," wrote Volexity in its report. "At the time of writing, this issue remains unresolved and (we are) not aware of an assigned CVE number."
For full technical details, see Volexity's report.
