FortiGuard Labs

#FortiGuardLabs is the global threat intelligence and research organization of @Fortinet.

[FortiGuard Labs @FortiGuardLabs]

Three infection chains with one objective: persistent access. ✅

Our team is tracing a BITTER campaign targeting South Asian organizations that blends native Windows tools, malicious shortcuts, and MSI installers to deploy #PapRAT, a custom RAT now evolving from C++ to Rust with expanded capabilities.

🔗 Follow for guidance and mitigation tips: https://t.co/vriz6887zJ

#FortiGuardLabs

[Fortinet @Fortinet]

The window between detection and impact is getting smaller.

In this short clip, #FortiGuardLabs’ Derek Manky previews how AI-powered attacks are accelerating the speed of risk and what that shift means for security operations.

Hear more from Derek and other experts this week at the 2026 Security Operations Summit, exploring how AI and automation are reshaping the modern SOC.

🗓️ November 4, 2026 | 9 AM PT
🔗 Secure your spot: https://t.co/HUsYmEmdXJ

[FortiGuard Labs @FortiGuardLabs]

Compressed data. Expanded risk. 💾 🚨

Our team is tracking Node2Shell, a critical vulnerability in Google’s Brotli decoder that can allow specially crafted compressed data to corrupt memory and potentially enable remote code execution.

🔗 Read our analysis and available protections: https://t.co/tUriTJpdMF

#FortiGuardLabs

[FortiGuard Labs @FortiGuardLabs]

We’re closely monitoring #PHP2Shell, two critical PHP vulnerabilities that can enable unauthenticated remote code execution across affected web applications.

We also released virtual patching and IPS protections to help organizations reduce exposure while permanent PHP updates are deployed.

Fortinet has also confirmed that #FortiOS and several other products are not affected.

🔗 Review the latest guidance and mitigation steps: https://t.co/srLbYFnDR6

[Fortinet @Fortinet]

.@FortiGuardLabs is closely monitoring PHP2Shell, two critical PHP vulnerabilities that can enable unauthenticated remote code execution across affected web applications.

Our teams have already released virtual patching and IPS protections to help reduce exposure while organizations test, deploy, and verify permanent PHP updates.

Fortinet has also confirmed that #FortiOS and several other Fortinet products are not affected.

🔗 Review the latest guidance, protections, and mitigation steps: https://t.co/0k8djzbNPN

[Fortinet @Fortinet]

We’re honored to be recognized by @CSIWorld with its 2026 Global Annual Cybersecurity Leadership Award, recognizing our work across threat intelligence, cybercrime disruption, and cybersecurity education. 🏆

The recognition reflects the work of our teams and partners to turn intelligence into action, support law enforcement, expand cybersecurity skills, and strengthen trusted channels for reporting cybercrime, including through initiatives like the Cybercrime Bounty program.

🔗 Read more: https://t.co/rFxQrKggcx

[FortiGuard Labs @FortiGuardLabs]

Our Researchers are tracking CVE-2026-21589, an arbitrary file access vulnerability affecting multiple #Atlassian Data Center products, including Bitbucket, Confluence, and Jira.

➡️ No authentication required
➡️ Specific files can be accessed if the path is known
➡️ UAE and U.S. are seeing the highest activity

🔗 Get the full analysis and mitigation guidance: https://t.co/AFoGeUaDrI

[Fortinet @Fortinet]

AI risk awareness is starting to turn into action.

One finding from the @WEF Global Cybersecurity Outlook 2026 is worth revisiting: the share of organizations assessing the security of AI tools jumped from 37% to 64% year over year. 📈

Learn why that shift matters as organizations work to keep pace with the security implications of AI adoption. https://t.co/h8yE8ZKhNe

[Fortinet @Fortinet]

Cybercrime rarely operates alone. It’s one piece of a larger puzzle that includes financial crime, trafficking, and corruption. This month in Panama City, the people working to solve that puzzle come together. 🧩

At the @CSIWorld 2026 Global Summit, themed “Cooperation Against Converging Crime,” @FortiGuardLabs' Derek Manky will join leaders from law enforcement, government, industry, and civil society to share how cybersecurity expertise strengthens the broader response to interconnected crime.

Through our Cybercrime Bounty program with CSI and our work with the Cybercrime Atlas, #Fortinet helps connect threat intelligence, community reporting, and investigative expertise. That turns isolated signals into coordinated action and makes criminal networks harder to sustain. 🔒

🔗 https://t.co/s4zqk5r3fV

[FortiGuard Labs @FortiGuardLabs]

A good threat report tells you what happened.
A threat-informed SOC asks a harder question: what should we do differently? 💬

#FortiGuardLabs’ Douglas Santos explains how mapping adversary TTPs to MITRE ATT&CK gives SecOps teams a more durable way to understand how attacks unfold and where defenses need attention.

🔗 See threat-informed SecOps in action: https://t.co/ZtR4WTJkq1

[FortiGuard Labs @FortiGuardLabs]

Need help getting through NAT? STUN. ❗️
Need help keeping a backdoor reachable? Also STUN. 😬

#FortiGuardLabs is tracking ClingSTUN, a Linux backdoor that exploits known, unpatched vulnerabilities in internet-facing IoT devices and abuses public STUN infrastructure to maintain connectivity.

The catch? Those STUN services are legitimate, helping the traffic blend in with normal VoIP and WebRTC activity.

🔗 See how #ClingSTUN works and what to watch for: https://t.co/39P6F9LQSq

[FortiGuard Labs @FortiGuardLabs]

The disguise wasn’t a fake app. It was what attackers did after installation. 🎭

#FortiGuardLabs uncovered a #SectopRAT malware campaign where attackers tampered with an existing legitimate software installation to quietly load the RAT.

Once active, SectopRAT can:

→ Steal browser credentials and payment data

→ Target crypto wallets and other applications

🔗 Read more from GBHackers: https://t.co/fsn7WgeIaC

[FortiGuard Labs @FortiGuardLabs]

CVSS 10.0. No authentication required. Active exploitation observed. 🚨

Our researchers are tracking CVE-2026-85706, a critical GitLab path traversal vulnerability that can allow attackers to read arbitrary files from vulnerable servers.

With public exploit code available, unpatched GitLab instances may be exposed.

🔗 Get the full analysis and mitigation guidance: https://t.co/if7uGkW5Es

#FortiGuardLabs

[FortiGuard Labs @FortiGuardLabs]

Trusted name. Unexpected behavior. 🚨 💻

@DarkReading examines new #FortiGuardLabs research into a #SectopRAT variant hidden inside legitimate software, giving attackers a way to borrow trust while staying under the radar.

The analysis uncovers how the malware was concealed, encrypted, and loaded to support remote control and data theft across compromised systems.

🔗 Read the latest: https://t.co/7p53fXrvVu

[FortiGuard Labs @FortiGuardLabs]

Looks legitimate. Runs legitimate. Carries a RAT. 🎭

Our team investigated a #SectopRAT variant concealed inside legitimate software and unpacked through a multi-stage loader before executing in memory.

Once active, it gives attackers broad remote control, including screen capture, file and process management, command execution, and access to sensitive data from browsers, email clients, gaming platforms, and crypto wallets.

🔗 See how the payload stays hidden and what it can do: https://t.co/6ZW1JhQO37

[FortiGuard Labs @FortiGuardLabs]

WORKFLOW STATUS: APPROVED ✅
AUTHENTICATION: NOT REQUIRED 🚫
RESULT: OS COMMAND EXECUTION 🚨

That is the problem with CVE-2026-58138.

#FortiGuardLabs is seeing active attack attempts against vulnerable Orkes Conductor deployments, where malicious workflow definitions can escape the intended scripting environment and execute commands on the underlying server.

🔗 Get the technical analysis: https://t.co/RlEGNxEFVF

[Fortinet @Fortinet]

For years, anonymity has worked in the cybercriminal's favor. What changes when it doesn't?

@FortiGuardLabs Derek Manky and @CSIWorld's Hayley van Loon discuss how the Cybercrime Bounty program is designed to raise the cost of operating in the shadows by giving people a trusted, anonymous way to share what they know.

The goal goes beyond disruption: accountability and deterrence.

🔗 See how Operation Silent Vector I is putting that model into action: https://t.co/OwbE8wdC8D

[Fortinet @Fortinet]

At @INTERPOL_HQ's 11th Americas Working Group on Cybercrime for Heads of Unit, Fortinet's Arturo E. Torres joined INTERPOL, the World Economic Forum (@wef) and Paraguayan authorities around a practical question: How do we turn threat intelligence into coordinated action across Latin America? 💬

This new blog shares how @FortiGuardLabs intelligence supports investigations and operations, and why disruption, not information sharing alone, is the real measure of public-private collaboration.

🔗 Read Arturo's perspective: https://t.co/8bVN9jsXWV

[FortiGuard Labs @FortiGuardLabs]

Casbaneiro is getting harder to read on purpose. 🕵️‍♂️

#FortiGuardLabs uncovered a new campaign targeting Latin America that uses geofencing, staged loaders, selective activation, and separate servers for stolen data to make the #malware appear inactive or inaccessible during analysis.

🔗 Explore the attack chain: https://t.co/7yISK9I9ps

[FortiGuard Labs @FortiGuardLabs]

Someone else may be spending your AI budget. 💸🤖

#FortiGuardLabs analyzed an Amazon Bedrock LLMjacking incident where a leaked AWS IAM key was used to create a new identity, subscribe to foundation models, and generate inference charges on the victim’s account.

Valid access. Real cost.

🔗 See how to spot LLMjacking: https://t.co/lFILEkVVji