Search: CVE-2025-59718

A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.

Researchers uncovered an AI-driven intrusion ecosystem operated by affiliates of INC and The Gentlemen ransomware groups via seven exposed command-and-control servers. The operators integrated commercial AI models, exploited edge devices at scale, and compromised thousands of targets, primarily in the US industrial manufacturing and healthcare sectors. The infrastructure included multiple custom encryptor builds and evidence of active victim encryption. Operational security failures exposed source code, credentials, AI session logs, and victim data. The campaign demonstrates advanced ransomware-as-a-service operations leveraging AI and custom tooling.

Malware#simplehelp#phantom frameworkUnited States