CVE-2018-13379 is a critical path traversal vulnerability in the Fortinet FortiOS SSL VPN web portal. It allows unauthenticated attackers to download FortiOS system files by sending specially crafted HTTP requests. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.
The Play ransomware group has been active since June 2022, targeting businesses and critical infrastructure in North America, South America, and Europe. They gain access by exploiting vulnerabilities, using stolen credentials, and leveraging remote access services. Their attacks follow a double extortion model, encrypting systems after exfiltrating data using AES-RSA hybrid encryption. The group employs various tools for network discovery, credential theft, and lateral movement. Organizations are advised to implement multifactor authentication, regular patching, network segmentation, and maintain offline backups to reduce risk.
