Skip to content Skip to navigation Skip to footer

FortiGuard Outbreak Alerts

Tactical steps to mitigate the latest cybersecurity attacks

Fortinet Named a Leader in the 2022 Gartner® Magic Quadrant™ for SD-WAN

Outbreak Alert

When a cybersecurity incident/attack/event occurs that has large ramifications to the cybersecurity industry and affects numerous organizations, FortiGuard Outbreak Alerts will be the mechanism for communicating important information to Fortinet's customers and partners. These Outbreak Alerts will help you understand what happened, the technical details of the attack and how organizations can protect themselves from the attack and others like it.

Sign up to receive updates on Outbreaks

Subscription Successful!

Request Failed. Please try again later!

Threat Signals and Outbreak Detection Service

Outbreak Detection Service

Outbreak Detection Service

Click here to access all Outbreak Alerts

Current Outbreak Alerts

Sep 30, 2022
Microsoft Exchange 0-day

Microsoft Exchange 0-day

Attack Type: Vulnerability Exploitation
Threat Actor: Unidentified

Two critical zero-day vulnerabilities (CVE-2022-41082 and CVE-2022-41040) that can allow the attacker to do a Remote Code Execution (RCE) on Microsoft Exchange Servers.

Jun 4, 2022
Zero Day

Confluence Vulnerability

Attack Type: Vulnerability Exploitation Leading to Remote Code Execution
Threat Actor: Unidentified

A critical 0-day vulnerability on Atlassian Confluence Data Center and Server is actively being exploited in the wild. The vulnerability is established via the Object Graph Navigation Language (OGNL) injection that allows an unauthenticated user to execute arbitrary code.

Jun 1, 2022
Log4j

Follina: MSDT 0-day

Attack Type: Vulnerability Exploitation
Threat Actor: Chinese APT actor TA413

This vulnerability (CVE-2022-30190) is a 0-day vulnerability in Microsoft Support Diagnostic Tool that allows remote code execution and is being exploited in the wild. More attacks are expected as Proof-of-Concept code is available and a patch has not yet been released.

Dec 9, 2021
Log4j

Log4j

Attack Type: Vulnerability Exploitation Leading to Remote Code Execution
Threat Actor: Multiple unidentified attackers

A zero-day vulnerability was discovered in Log4j, a Java-based logging utility that is part of Apache Logging Services Project. Deployed on millions of servers, this vulnerability can be exploited to allow for remote code execution and total system control on vulnerable systems.

July 1, 2021
Kaseya VSA

Kaseya VSA

Attack Type: Vulnerability Exploitation and REvil Ransomware-as-a-Service
Threat Actor: REvil plus unidentified associate

A sophisticated supply-chain ransomware attack that leveraged a vulnerability in the Kaseya VSA software to infect multiple managed service providers (MSPs) and their customers. We provide Outbreak Alert analyses for both the initial exploitation and the subsequent ransomware attack.

June 30, 2021
Microsoft Print Spooler

Microsoft Print Spooler

Attack Type: Vulnerability Exploitation
Threat Actor: Unidentified

A potentially new zero-day Microsoft vulnerability, dubbed "PrintNightmare," makes it possible for any authenticated attacker to remotely execute code with SYSTEM privileges on any machine that has the Windows Print Spooler service enabled (which is the default setting).

May 6, 2021
Colonial Pipeline

Colonial Pipeline

Attack Type: Ransomware
Threat Actor: DarkSide

Operation Technology (OT) Attack. These actions temporarily halted all pipeline operations and affected some of their IT systems, causing gas shortages and taking weeks to recover.

Mar 10, 2021
F5 Big IP

F5 Big IP

Attack Type: Vulnerability Exploitation
Threat Actor: Multiple

F5 reported several new vulnerabilities under attack that could lead to complete system compromise.  F5 urged immediate upgrades.

Jan 6, 2021
Microsoft Exchange

Microsoft Exchange

Attack Type: Vulnerability Exploitation and DearCry Ransomware
Threat Actor: HAFNIUM

The original Zero-Day vulnerabilities were exploited and used by the HAFNIUM group for the global Ransomware campaign

Dec 2020
SolarWinds

SolarWinds

Attack Type: Hack (Sunburst, Teardrop, Raindrop malware
Threat Actor: Russian Foreign Intelligence Service (SVR)

A complex & targeted supply chain cyber attack, with the primary goal of inserting a malicious backdoor into trusted (signed) software, which could later be exploited in end-customer updates of the SolarWinds Orion platform.

FortiGuard Outbreak Alerts

FortiGuard Outbreak Alerts will be the mechanism for communicating important information to customers and partners.  When a cybersecurity incident/attack/event occurs that has large ramifications to the cybersecurity industry and affects numerous organizations, this page will be updated with a link to the individual FortiGuard Outbreak Alert.  That Alert will include:

  • An explanation of the attack, its timeline and what specific technology was affected
  • Where applicable patches and/or mitigation recommendations can be found
  • What Fortinet products, if deployed, would break the attack sequence
  • What specific versions those Fortinet products need to be at to provide the protection
  • Threat Hunting tools from Fortinet to help you determine if you were affected
  • Related research from FortiGuard Labs
Click here to learn more about our FortiGuard suite of market-leading, AI-enabled security capabilities.