Since late September we have observed an initial-access broker exploiting CVE-2024-21762 in FortiOS SSL VPN to gain a foothold on internet-exposed appliances. Exploitation attempts originated from 203.0.113.47 and 198.51.100.212. After access, the actor created local administrator accounts on the firewall and used the SSL VPN as a persistent entry point, with access later sold to ransomware operators. Victims so far are concentrated in healthcare and professional services across the EU.
Threat intel for companies that don't have a security team.
Every day, security vendors and governments publish reports on who is being attacked and how. doteye reads them, works out which ones touch the software you run and the industry you're in, and tells you what to do about it in plain language.
One report, read for one business
Your firewall has a known hole that attackers are using right now.
Your FortiGate 60F runs FortiOS 7.2.4. That version has a flaw that's being used to break into firewalls at clinics and small firms in the EU, and the access gets sold on to ransomware gangs.
- Update FortiOS to 7.2.7 or later. If your IT provider looks after the firewall, forward them this alert.
- Until it's updated, switch off SSL VPN if nobody needs to work remotely.
- Check the firewall's admin accounts for any name nobody recognises.
- Block the two addresses below.
Technical detail for your IT provider
- Vulnerability
- CVE-2024-21762
- Block
- 203.0.113.47, 198.51.100.212
A phishing campaign aimed at the logistics sector sends fake freight invoice notifications containing links to login pages hosted on cargo-docview[.]net and invoice-trackportal[.]com. The pages relay the real Microsoft 365 sign-in and capture the session token, so one-time MFA codes do not stop them. Stolen sessions are used to sign in to mailboxes and add inbox rules that hide replies from customers, followed by emails asking customers to pay into a new bank account.
Fake freight invoices are stealing Microsoft 365 logins in your sector.
You're a freight forwarder on Microsoft 365, and this campaign is aimed squarely at logistics companies. It gets past the six-digit codes your team uses to sign in.
- Tell your team not to sign in through links in "invoice" or "shipment document" emails, even from carriers they know.
- Have your IT provider block the two sites below in Microsoft 365.
- Check every mailbox for new rules that move or delete incoming mail.
- If a customer is asked to change bank details by email, confirm by phone before anything is paid.
Technical detail for your IT provider
- Block
- cargo-docview[.]net, invoice-trackportal[.]com
Attackers continue to exploit CVE-2024-1709, an authentication bypass in on-premises ConnectWise ScreenConnect, to create administrator users and push remote access tooling to every endpoint the server manages. In recent intrusions a loader with SHA-256 a3f19c…e07b9c2e was deployed shortly before files were encrypted. Accounting and tax firms are a recurring target because of the client data they hold.
The remote-support tool your IT provider uses can be taken over.
Your IT provider connects to your 18 PCs through a self-hosted ScreenConnect server. Older versions let anyone on the internet make themselves an admin, and from there reach every PC at once. Firms like yours are being hit with ransomware this way.
- Call your IT provider today and ask whether your ScreenConnect server is on version 23.9.8 or later.
- If they can't confirm it, ask them to take it offline until it is.
- Ask them to check for admin users created in the last 30 days.
- Make sure last night's backup is stored somewhere your PCs can't reach.
Technical detail for your IT provider
- Vulnerability
- CVE-2024-1709
- Hunt for
- SHA-256 a3f19c…e07b9c2e
- indicator addresses, domains, hashes, CVEs
- technique what the attackers did
- who's targeted matched to your industry
Hover or tap a highlight to see where it ends up. Companies, IP addresses and the hash are made up for this example.
What happens between a report and your inbox
Big companies pay analysts to do this all day. doteye does the reading for you, and keeps the output tied to the things you told us you run.
-
Collect
Threat feeds, vendor research, government and CERT advisories, and open sources like security forums and paste sites.
-
Read
We read each item the way an analyst would and pull out the indicators (IP addresses, domains, file hashes, CVEs) and who's behind it.
-
Map
What the attackers did is written down the same way every time, so "they got in through the VPN" in one report lines up with the same move in the next.
-
Match
Every finding is checked against your profile: the products and versions you run, your domains, your industry, your country.
-
Tell you
If it touches you, you get an alert ranked by urgency, with steps written for whoever handles your IT. If it doesn't, you don't hear about it.
For the person who ends up “doing the IT”
The office manager who knows the router password. The one IT person at a 60-person company. The outside provider who looks after ten clients like you. doteye is written for them.
What you get
- Alerts only when a threat involves software you use or companies like yours
- A clear priority on each one, so you know what can wait
- Steps you can do yourself or forward as-is to your IT provider
- The technical detail attached, for whoever needs it
What you don't
- A feed of 40,000 indicators to sort through
- A dashboard you have to learn before it's useful
- Warnings about products you've never installed
- Jargon without an explanation
We're onboarding a small group of businesses first.
Leave your work email and we'll get in touch to set up your profile. It takes about fifteen minutes and you'll need a rough list of the software you use.