What is the attack?FortiGuard Labs’ Recon team is aware of communications on a cybercrime forum known as ‘BreachForums’ with a Threat Actor (TA) known by the alias ‘IntelBroker.’ This threat actor has posted about selling access to various internal resources of several undisclosed organizations. The Threat Actor (TA) claimed to have acquired access to the sensitive information by breaching a single, unnamed company that provides services to over 400 organizations, primarily in the US. The TA disclosed a list of over 400 organizations compromised. Based on this information and active exploitations, the FortiRecon team has ascertained that several of the compromised organizations are customers/clients of MSP Cprime’s services and suspect an attack through their infrastructure to be the source of the attack.What is the recommended Mitigation?At this point, it is unclear what the attack vector into the MSP network was, or how onward access was gained into the victim organization network however; there have been mentions of access being gained to Github, Jira, and Confluence instances. At this point, Fortinet recommends increased vigilance to identify any unusual network or server activity. Fortinet customers could use FortiRecon’s Digital Risk Protection (DRP) service to help counter attacks at the reconnaissance phase and significantly reduce the risk, time, and cost of later-stage threat mitigation. https://www.fortinet.com/products/fortirecon What FortiGuard Coverage is available?FortiGuard Labs’ research team is currently investigating and monitoring this situation closely and will provide more information as it becomes available. FortiGuard Incident Response team can be engaged to help with any suspected compromise.

Read More