FortiJump: FortiManager Zero-Day Config Heist
A FortiManager appliance is breached through an FGFM authentication bypass (the FortiJump zero-day): an attacker-controlled FortiManager registers itself as a trusted device, stages every managed FortiGate's configuration into a single hidden archive on the appliance, and exfiltrates it over HTTPS, stealing the fleet inventory and FortiOS256-hashed administrator passwords. Weeks later the operator re-registers and exfiltrates again to fresh infrastructure. With no malware on any firewall and no endpoint to inspect, reconstruct the entire heist from the appliance event log and perimeter firewall alone.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Find where the intruder reached the management plane
40Legitimate firewall registrations come only from inside. Identify the external address that opened a management session to the appliance and forced its way in.
Identify the rogue device
40A foreign management device registered itself as trusted. Recover the serial number that should never have been there.
Locate the staged loot
40Before anything left the network, the configurations were bundled in one place on the appliance. Identify the file path of the staged archive.
Separate the data theft from the callback
45The operator kept control and data on different hosts. Identify the external IP that received the first stolen archive.
Confirm the re-entry and second drop
45Weeks later the actor came back and exfiltrated again to fresh infrastructure. Identify the external IP that received the second stolen archive.
Classify the exfiltration technique
35Name how the stolen configurations left the network. Classify the exfiltration technique with its ATT&CK ID.
7 tasks · 245 points total
Training Tools
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.