Skip to content
Today
Sections

Research lab

FortiGuard Labs

Fortinet's threat intelligence and research division, tracking malware, botnets, and vulnerabilities to produce security advisories and protections.

Known aliases

  • FortiGuard
  • Fortinet
  • Fortinet FortiGuard Labs

Current stories

securityConfirmed3 publishers

ClingSTUN backdoor turns vulnerable Linux devices into proxies that check in through public STUN servers

FortiGuard Labs says the ClingSTUN Linux backdoor exploits two dozen flaws in a dozen vendors' gear and carries seven more to spread itself. Exploitation is indiscriminate, so any reachable vulnerable device on those lists, Ivanti's included, can join its proxy pool.

Publishers:infosecurity-magazine.com securityaffairs.com securityweek.com

Perspective Coverage

3 publishers
Builder
Builder 33%
Operator
Operator 57%
Investor
Investor 10%

Reality

Evidence60
Adoption
Not scored
Hype gap+10
Incentives40
Confidence58
securityConfirmed5 publishers

Evooo1Bot turns edge gear into rentable proxy stock, and the tell is outbound

Fortinet says the Mirai-derived botnet bolts a SOCKS5 relay onto compromised routers, cameras and Confluence hosts. Sellable proxy capacity changes what you hunt for.

Publishers:bleepingcomputer.com infosecurity-magazine.com securityaffairs.com thehackernews.com therecord.media

Perspective Coverage

5 publishers
Builder
Builder 25%
Operator
Operator 63%
Investor
Investor 12%

Reality

Evidence60
Adoption
Not scored
Hype gap+10
Incentives30
Confidence65
securityOne report1 publisher

CISA orders Ray patched as RondoDox folds cluster software into a 174-exploit arsenal

A code injection flaw in Ray is now on CISA's mandatory fix list after BitSight saw a Mirai-derived botnet exploiting it. Compute clusters are being swept with the same traffic as routers.

Publishers:securityweek.com

Reality

Evidence48
Adoption55
Hype gap+22
Incentives52
Confidence52
buildOne report1 publisher

One Mirai variant now proxies, sniffs and spreads: the appliance layer is a pivot, not DDoS fodder

FortiGuard Labs says Evooo1Bot packs SOCKS5 relaying, credential sniffing, SSH spreading and 16 flood modes into one binary across 12 CPU architectures. The tunnel matters more than the flood.

Publishers:dev.to

Reality

Evidence48
Adoption
Not scored
Hype gap+18
Incentives58
Confidence42