DEEPDATA Malware Leverages Unpatched Fortinet Flaw Exposing VPN Credentials to Cyber Espionage
Cybersecurity researchers have uncovered a significant new threat targeting Fortinet's FortiClient VPN, highlighting the alarming capabilities of malware known as DEEPDATA. This sophisticated attack, attributed to the BrazenBamboo threat group, exploits a zero-day vulnerability to steal sensitive VPN credentials, leaving businesses and individuals at heightened risk of espionage and data theft.
Table of Contents
How DEEPDATA Exploits the Fortinet Vulnerability
Disclosed by cybersecurity firm Volexity, DEEPDATA leverages a previously unknown vulnerability in FortiClient for Windows to harvest VPN credentials directly from memory. This flaw, reported to Fortinet in July 2024, remains unpatched as of this writing. The unaddressed vulnerability allows attackers to exploit Fortinet's popular VPN software to gain unauthorized access to corporate networks, potentially enabling further infiltration and data theft.
At the heart of DEEPDATA is a dynamic-link library (DLL) loader, data.dll, which decrypts and activates 12 malicious plugins through an orchestrator module called frame.dll. One plugin, specifically targeting FortiClient, extracts VPN credentials, granting attackers a stealthy foothold within compromised environments.
DEEPDATA: A New Level of Espionage
DEEPDATA’s capabilities are part of a broader toolkit engineered by BrazenBamboo, a group closely linked to the China-associated APT41 threat actor. The malware suite expands on earlier frameworks like LightSpy, a versatile spyware platform targeting macOS, iOS, and Windows.
Key features of DEEPDATA and its related tools include:
- Credential Theft: Captures credentials from popular communication apps such as WhatsApp, Telegram, Signal, and KeePass.
- Data Exfiltration: Gathers web browser details, application passwords, Wi-Fi hotspot data, and information about installed software.
- Persistent Surveillance: Maintains stealthy, long-term access to target devices for comprehensive espionage.
This multi-functional malware highlights a meticulous focus on communication platforms, with attackers prioritizing stealth and persistence to maximize intelligence-gathering opportunities.
DEEPPOST and LightSpy: Complementary Tools for Advanced Attacks
BrazenBamboo’s cyber arsenal doesn’t stop at DEEPDATA. Its DEEPPOST tool facilitates data exfiltration, enabling attackers to transfer stolen files to remote servers. Meanwhile, the LightSpy framework, operational since 2022, demonstrates advanced modularity, employing specialized plugins to:
- Record webcam footage.
- Execute commands via a remote shell.
- Collect audio, keystrokes, and browser data.
- Capture screen images and inventory installed software.
LightSpy’s architecture for Windows variants, deployed via a custom installer, suggests its development is part of a systematic and well-funded effort to create bespoke hacking tools.
Implications for Cybersecurity and Espionage
The overlap in code and infrastructure between DEEPDATA and LightSpy suggests that these malware families may stem from private enterprises contracted to develop tools for nation-state actors. Companies such as Chengdu 404 and I-Soon are prime examples of organizations implicated in crafting offensive cyber tools for government use.
The discovery of DEEPDATA highlights the growing trend of modular malware frameworks designed for multi-platform capabilities. This approach enables threat actors like BrazenBamboo to adapt their tools for various operating systems and environments, ensuring operational longevity and effectiveness.
Urgent Steps for Protection
Given the ongoing risk posed by DEEPDATA and the unpatched Fortinet vulnerability, it is crucial for organizations and users to take immediate steps to mitigate potential damage:
- Monitor for Patches: Stay updated on security patches from Fortinet and apply them as soon as they become available.
- Enhance Network Monitoring: Implement robust endpoint detection and response (EDR) solutions to identify unusual activity.
- Conduct Credential Audits: Regularly change VPN credentials and monitor for unauthorized access attempts.
- Segment Networks: Limit access to critical resources to minimize the impact of compromised credentials.
The DEEPDATA malware underscores the high stakes of unresolved vulnerabilities in widely used software. As threat actors like BrazenBamboo continue to refine their tools, organizations must remain vigilant, employing layered defenses and proactive vulnerability management to counter advanced cyber threats.
The clock is ticking on addressing the Fortinet flaw—businesses and individuals must act quickly to protect their sensitive data and digital assets.
