New BOLDMOVE Malware Exploits Flaw in Fortinet Devices

Summary

Mandiant identified a new malware tracked as “BOLDMOVE” exploiting a recently patched FortiOS vulnerability. Fortinet released a PSIRT Advisory on December 12 urging customers to apply patches immediately, as exploitation of CVE-2022-42475 (CVSS v3.1 9.8), a critical heap-based buffer overflow vulnerability, was observed in the wild. However, evidence suggests that exploitation occurred as early as October, with targets including a European government entity and a managed service provider located in Africa.

Both Windows and Linux variants of BOLDMOVE were discovered and are specifically designed to run on FortiGate Firewalls with the intent to conduct cyber espionage. Several versions were identified containing various capabilities, though its core features include system surveying, spawning a remote shell on the breached device, and establishing a command-and-control (C2) connection to relay commands and exfiltrate data.

The Linux BOLDMOVE version allows attackers to modify Fortinet logs on the compromised system or disable logging daemons, limiting intrusion detection. Additionally, this version can send requests to internal Fortinet services, allowing attackers to conduct lateral movement and send network requests to the entire internal network. Researchers assess that Chinese hackers are behind the attacks due to the tactics and targeting protocols used and will likely continue to target unpatched internet-facing devices.

Recommendations

The NJCCIC recommends administrators apply updates immediately after appropriate testing. Organizations are strongly encouraged to regularly perform vulnerability scans of internal enterprise assets. Organizations can significantly strengthen their security posture by establishing and following a comprehensive patch management policy and prioritizing the remediation of the vulnerabilities listed in the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. Additional technical details and indicators of compromise (IOCs) can be found in the Mandiant blog post.