Fortinet VPNs Face Zero-Day Threat as Ransomware Groups Evolve Attack Methods

Security monitoring firm GreyNoise has detected active attempts to brute-force Fortinet VPNs, suggesting the existence of a zero-day vulnerability. The attacks also potentially affect FortiSIEM security tools, putting organizations using Fortinet's security infrastructure at increased risk. Security experts are advising organizations to maintain heightened vigilance and monitor their VPN systems closely for suspicious activity. ^[1]

In a parallel development, researchers have discovered that at least a dozen ransomware gangs have developed sophisticated methods to disable endpoint detection and response (EDR) systems. These groups are using a combination of custom malware and legitimate software tools to implement kernel-level EDR killing capabilities, effectively neutralizing traditional security measures. ^[2]

A new ransomware strain called Charon has emerged, targeting sectors in the Middle East with advanced APT-level evasion tactics. This previously undocumented ransomware family demonstrates the continuing evolution of cyber threats, employing sophisticated techniques typically associated with state-sponsored actors. ^[3]

Microsoft has responded to the escalating threat landscape by releasing patches for 111 security vulnerabilities in its latest update, including a critical Kerberos zero-day flaw. This comprehensive security update addresses vulnerabilities across Microsoft's software portfolio, highlighting the importance of prompt patching in maintaining cyber defenses. ^[4]

1. Fortinet VPNs under attack from potential zero-day - FortiSIEM security tools also at risk, so be on your guard
2. Ransomware crews don't care about your endpoint security – they've already killed it
3. Charon Ransomware Hits Middle East Sectors Using APT-Level Evasion Tactics
4. Microsoft August 2025 Patch Tuesday Fixes Kerberos Zero-Day Among 111 Total New Flaws