Between late January and early March, Forescout Research – Vedere Labs identified a series of intrusions based on two Fortinet vulnerabilities. It began with the exploitation of Fortigate firewall appliances — culminating in the deployment of a newly discovered ransomware strain we have dubbed SuperBlack.

• Our 2024 Dray:Break report revealed 14 new vulnerabilities in DrayTek devices
  *See our upcoming presentation at Black Hat Europe for more details
• PRODAFT shared threat intelligence from 2023 on a ransomware campaign exploiting DrayTek devices
• This is the first time this campaign is discussed publicly
• Our analysis shows sophisticated attack workflows to deploy ransomware including possible:
  • Zero-day vulnerabilities
  • Credential harvesting and password cracking
    VPN and tunneling abuse