New Threat Alert: Rustobot Botnet
A new Rust-based botnet is making waves — and it's hijacking routers to do it. @FortiGuardLabs latest research dives into Rustobot, a stealthy, modular botnet that’s fast, evasive, and ready to wreak havoc.

Learn how it works, what makes it different, and how to protect your network:
https://www.fortinet.com/blog/threat-research/new-rust-botnet-rustobot-is-routed-via-routers

IOCs

URLs

hxxp://66[.]63[.]187[.]69/w.sh
hxxp://66[.]63[.]187[.]69/wget.sh
hxxp://66[.]63[.]187[.]69/t
hxxp://66[.]63[.]187[.]69/tftp.sh
hxxp://66[.]63[.]187[.]69/arm5
hxxp://66[.]63[.]187[.]69/arm6
hxxp://66[.]63[.]187[.]69/arm7
hxxp://66[.]63[.]187[.]69/mips
hxxp://66[.]63[.]187[.]69/mpsl
hxxp://66[.]63[.]187[.]69/x86

Hosts

dvrhelper[.]anondns[.]net
techsupport[.]anondns[.]net
rustbot[.]anondns[.]net
miraisucks[.]anondns[.]net
5[.]255[.]125[.]150

Edit: Shout-out to the author behind this research, @7olzu

Over 16,000 Fortinet devices have been compromised with a stealthy symlink backdoor — even after being patched.

A report from The Shadowserver Foundation reveals that attackers left behind a persistent backdoor on FortiGate devices by abusing symbolic links. These links provide read-only access to sensitive configuration files, even after vulnerabilities were patched.

Here’s what happened:
- Threat actors exploited FortiOS zero-days throughout 2023 and 2024
- They planted symbolic links in language file folders on SSL-VPN enabled devices
- These links connected public folders to the root filesystem
- Even after patching, the symlinks gave attackers continued visibility into sensitive files

Fortinet says this isn’t due to a new vulnerability — it’s a "persistence mechanism" that evaded detection by living in user-accessible directories.

The impact:
- Over 16,000 devices globally are affected
- Attackers may have had access to configuration files, including credentials
- Fortinet is notifying affected customers and has released updated AV/IPS signatures to detect and remove the malicious symlinks

If you're using FortiGate:
- Check for recent alerts from Fortinet
- Update to the latest firmware
- Reset all credentials
- Audit logs for suspicious access behavior

At Efani, we view this as a critical reminder: patching isn’t the end of an incident — it’s the start of validation. Persistence mechanisms like this one don’t need new vulnerabilities to survive.

Over 16,000 #Fortinet devices compromised with #symlink backdoor

https://www.bleepingcomputer.com/news/security/over-16-000-fortinet-devices-compromised-with-symlink-backdoor/

Si tu gères un firewall #Fortigate (ou tu connais quelqu’un qui en administre un) avec SSL-VPN activé, prends 2 min pour vérifier s’il est compromis.

Depuis les attaques massives de 2024, des cybercriminels laissent des liens symboliques planqués dans les fichiers de langue. Résultat : même après patch, ils gardent accès au système.

Plus de 16 000 appareils compromis dans le monde, dont 208 en Suisse (source : Shadowserver).

Fortinet a publié un correctif + une signature AV/IPS pour nettoyer, mais faut mettre à jour.

https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity
[dans les news]
https://www.bleepingcomputer.com/news/security/over-16-000-fortinet-devices-compromised-with-symlink-backdoor/

https://dashboard.shadowserver.org/statistics/combined/tree/?day=2025-04-11&source=compromised_website&source=compromised_website6&tag=fortinet-compromised%2B&geo=all&data_set=count&scale=log

Et pour rappel : si vous administrez pour une entreprise, institution ou toute entité titulaire d’un AS ou de plages IP définies, vous pouvez recevoir des alertes directes de la fondation @shadowserver si un de vos équipements en frontière est détecté comme compromis.

Inscription ici : https://www.shadowserver.org/what-we-do/network-reporting/get-reports/

Massive Cybersecurity Breach: 16,000 Fortinet Devices Compromised via Symlink Backdoor

A staggering 16,620 Fortinet devices have been compromised using a sophisticated symlink backdoor, allowing threat actors to maintain persistent read-only access to sensitive files. This breach highli...

https://news.lavx.hu/article/massive-cybersecurity-breach-16000-fortinet-devices-compromised-via-symlink-backdoor

LOL Fortinet

BleepingComputer: Over 16,000 Fortinet devices compromised with symlink backdoor

https://www.bleepingcomputer.com/news/security/over-16-000-fortinet-devices-compromised-with-symlink-backdoor/

Fortinet advierte que atacantes pueden conservar el acceso incluso después de la aplicación de parches https://blog.elhacker.net/2025/04/fortinet-advierte-atacantes-mantienen-acceso-tras-aplicacion-parche-seguridad.html #vulnerabilidad #persistencia #fortinet #Rootkit #bug #cve

Australian Businesses at Risk as Threat Actors Exploit Fortinet Vulnerabilities https://thecyberexpress.com/fortinet-urges-australia-to-patch-now/ #AustralianCyberSecurityCentre #CybersecurityBestPractices #TheCyberExpressNews #VulnerabilityNews #Fortinetproducts #Vulnerabilities #TheCyberExpress #FirewallDaily #CyberNews #Features #Fortinet #SSLVPN

Fortinet Zero-Day Bug May Lead to Arbitrary Code Execution – Source: www.darkreading.com https://ciso2ciso.com/fortinet-zero-day-bug-may-lead-to-arbitrary-code-execution-source-www-darkreading-com/ #rssfeedpostgeneratorecho #DarkReadingSecurity #CyberSecurityNews #DARKReading #Fortinet

Fortinet Issues Fixes After Attackers Bypass Patches to Maintain Access https://hackread.com/fortinet-fixe-attackers-bypass-patches-maintain-access/ #Cybersecurity #Vulnerability #CyberAttacks #CyberAttack #Security #backdoor #Fortinet #Malware

Threat Actor Allegedly Selling Fortinet Firewall Zero-Day Exploit – Source: www.securityweek.com https://ciso2ciso.com/threat-actor-allegedly-selling-fortinet-firewall-zero-day-exploit-source-www-securityweek-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #Malware&Threats #vulnerabilities #securityweekcom #CVE-2022-42475 #CVE-2023-27997 #CVE-2024-21762 #securityweek #ThreatMon #FEATURED #Fortinet #FortiOS

Threat Actor Allegedly Selling Fortinet Firewall Zero-Day Exploit https://www.securityweek.com/threat-actor-allegedly-selling-fortinet-firewall-zero-day-exploit/ #Malware&Threats #Vulnerabilities #CVE202242475 #CVE202327997 #CVE202421762 #ThreatMon #Fortinet #FortiOS

Threat Actor Allegedly Selling Fortinet Firewall Zero-Day Exploit https://www.securityweek.com/threat-actor-allegedly-selling-fortinet-firewall-zero-day-exploit/ #Malware&Threats #Vulnerabilities #CVE202242475 #CVE202327997 #CVE202421762 #ThreatMon #Fortinet #FortiOS

Old Fortinet flaws under attack with new method its patch didn’t prevent – Source: go.theregister.com https://ciso2ciso.com/old-fortinet-flaws-under-attack-with-new-method-its-patch-didnt-prevent-source-go-theregister-com/ #rssfeedpostgeneratorecho #TheRegisterSecurity #CyberSecurityNews #TheRegister #Fortinet

Hackers exploit Fortinet flaws to plant stealth backdoors on FortiGate devices, maintaining access even after patches.

Read: https://hackread.com/fortinet-fixe-attackers-bypass-patches-maintain-access/

Hackers retain access to over 14,000 Fortinet VPNs, public scans by Shadowserver Foundation have revealed.

#hack #cybersecurity #Fortinet #VPN

https://cnews.link/fortinet-hackers-maintaining-access-despite-patches-1/

Symbolic Link trick lets attackers bypass FortiGate patches, Fortinet warns – Source: securityaffairs.com https://ciso2ciso.com/symbolic-link-trick-lets-attackers-bypass-fortigate-patches-fortinet-warns-source-securityaffairs-com/ #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #BreakingNews #SecurityNews #hackingnews #Fortinet #FortiOS #hacking