Exposing POLONIUM activity and infrastructure targeting Israeli organizations
microsoft.com · 2 Jun 2022 · Licence: not assessed; coordinator-only cache; do not redistribute
CVEs this report names
1 CVE- CVE-2018-13379Fortinet FortiOS SSL VPN Path Traversal VulnerabilityFortinet · FortiOSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application5 reports>99.9%Top 0.01%89.9priority
Where it names them
CVE-2018-13379 Original (opens in a new tab) ↗
This suggests, but does not definitively prove, that POLONIUM compromised these Fortinet devices by exploiting the CVE-2018-13379 vulnerability to gain access to the compromised organizations.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.