The spies exploited the path traversal vulnerability by using the command 'execute wireless-controller hs20-icon upload-icon.' Normally, this command is used to upload icon files from a server to a FortiGate firewall, where they can be used in HotSpot 2.0 Online Sign-Up portals (HotSpot 2.0 allows devices to switch seamlessly between cellular data and public Wi-Fi). These scripts took advantage of CVE-2022-41328. Then, they used FortiManager scripts to deploy the CASTLETAP backdoor across multiple FortiGate firewalls. The first one, which occurred when the threat actor initially gained access to the Fortinet ecosystem while the FortiManager device was exposed to the internet, uses the CASTLETAP backdoor plus another novel malware named THINCRUST.Īfter gaining access to an internet-facing device, the criminals used the THINCRUST - a Python-based backdoor disguised as a legitimate API call - to establish persistence on FortiManager and FortiAnalyzer devices. There are two different attack paths that the suspected Chinese criminals have used to compromise Fortinet devices. Breaking in to internet-connected security devices Analyzing these devices led to the discovery of yet another new malware family that Mandiant dubbed CASTLETAP, which is an ICMP port-knocking backdoor.

They also determined that the miscreants crippled security tools on the target systems.