TL;DR
['FortiGate RaaS is active, exploiting vulnerabilities in Fortigate devices. Citrix also faces new exploitation methods. Network components remain at risk requiring immediate action.']
What happened
['A threat actor group has launched a ransomware-as-a-service (RaaS) campaign targeting Fortigate devices.', 'Exploits have been found targeting various versions of Citrix products, leading to potential data breaches and system downtimes.']
Why it matters for ops
['These exploits pose significant risks to network security and operational integrity due to the widespread use of affected components in enterprise environments.']
Mitigation
- Apply available security patches for affected components immediately.
- Monitor network traffic closely for any unusual activity related to the exploits.
- Implement strict access controls and authentication measures.
Action items
- Review system configurations and ensure compliance with security best practices.
- Conduct regular vulnerability scans and penetration testing.
- Educate employees on phishing attacks targeting live chat platforms.
Detection IOCs
- Unexpected outbound connections from Fortigate devices
- Increased login attempts on Citrix interfaces
- Unusual data exfiltration activities
Source link
https://thehackernews.com/2026/03/threatsday-bulletin-fortigate-raas.html