Chinese Hackers Breached 20,000 FortiGate Systems Worldwide

The Dutch Military Intelligence and Security Service (MIVD) has issued a warning about the extensive impact of a Chinese cyber-espionage campaign. The campaign, which was unveiled earlier this year, is reportedly “much larger than previously known.”

As disclosed by the MIVD in February, in a joint report with the General Intelligence and Security Service (AIVD), Chinese hackers exploited a critical FortiOS/FortiProxy remote code execution vulnerability (CVE-2022-42475). This exploitation occurred over several months between 2022 and 2023, during which the hackers deployed malware on vulnerable Fortigate network security appliances.

During this ‘zero-day‘ period, the actor infected 14,000 devices alone. The targets included dozens of (Western) governments, international organizations, and a large number of companies within the defense industry.

The Coathanger remote access trojan (RAT) malware used in the attacks was also found on a Dutch Ministry of Defence network used in the research and development (R&D) of unclassified projects. However, due to network segmentation, the attackers were blocked from moving to other systems.

This previously unknown malware strain, which could survive system reboots and firmware upgrades, was deployed by a Chinese state-sponsored hacking group in a political espionage campaign targeting the Netherlands and its allies.

This gave the state actor permanent access to the systems. Even if a victim installs security updates from FortiGate, the state actor continues to keep this access. It is not known how many victims actually have malware installed. The Dutch intelligence services and the NCSC consider it likely that the state actor could potentially expand his access to hundreds of victims worldwide and carry out additional actions such as stealing data.

Since February, the Dutch military intelligence service has discovered that the Chinese threat group obtained access to at least 20,000 FortiGate systems worldwide in 2022 and 2023 over a span of a few months, at least two months before Fortinet disclosed the CVE-2022-42475 vulnerability.

The MIVD believes the Chinese hackers still have access to many victims because the Coathanger malware is difficult to detect as it intercepts system calls to avoid revealing its presence and is also challenging to remove since it survives firmware upgrades.

CVE-2022-42475 was also exploited as a zero-day to target government organizations and related entities, as disclosed by Fortinet in January 2023. These attacks bear many similarities to another Chinese hacking campaign that targeted unpatched SonicWall Secure Mobile Access (SMA) appliances with cyber-espionage malware designed to withstand firmware upgrades.

The revelations from the MIVD highlight the ongoing threat posed by state-sponsored cyber-espionage campaigns and the importance of robust cybersecurity measures to protect against such threats.

You may also like: