FortiMail Workspace Security: PowerShell attack on Israeli orgs

A single script. Full network compromise. 💻 🚨 #FortiMail Workspace Security uncovered a PowerShell-only attack targeting Israeli organizations—delivering a multi-stage RAT with no external executables, obfuscated payloads, and signs of lateral movement. 🔗 Read FortiGuard Labs' full technical analysis: https://ftnt.net/6045fxpA1

A single script. Full network compromise. 💻 🚨 #FortiMail Workspace Security uncovered a PowerShell-only attack targeting Israeli organizations—delivering a multi-stage RAT with no external executables, obfuscated payloads, and signs of lateral movement. 🔗 Read FortiGuard Labs' full technical analysis: https://ftnt.net/6046faO2u

A single script. Full network compromise. 💻 🚨 #FortiMail Workspace Security uncovered a PowerShell-only attack targeting Israeli organizations—delivering a multi-stage RAT with no external executables, obfuscated payloads, and signs of lateral movement. 🔗 Read FortiGuard Labs' full technical analysis: https://ftnt.net/6049faWYc

A single script. Full network compromise. 💻 🚨 #FortiMail Workspace Security uncovered a PowerShell-only attack targeting Israeli organizations—delivering a multi-stage RAT with no external executables, obfuscated payloads, and signs of lateral movement. 🔗 Read FortiGuard Labs' full technical analysis: https://ftnt.net/6043fft49

$2.8B in reported losses to Business Email Compromise (BEC) attacks in 2024 (USA only). 70% of organizations were targeted by a BEC attack in the last 12 months. Consider #FortiMail offered as Cloud Hosted (#SEG) or Cloud SaaS (#ICES).

A single script. Full network compromise. 💻 🚨 #FortiMail Workspace Security uncovered a PowerShell-only attack targeting Israeli organizations—delivering a multi-stage RAT with no external executables, obfuscated payloads, and signs of lateral movement. 🔗 Read FortiGuard Labs' full technical analysis: https://ftnt.net/6047fNRtb

ImageIO sits in the critical path between untrusted content and system memory — a dangerous position for exploitation. This incident underscores the broader risk of document and media parsers as supply-chain attack surfaces. Security posture must evolve to treat these paths with zero-trust, including: Hardened memory boundaries EDR/XDR visibility into image parsing Process isolation for media handling This latest zero-day is a stark reminder: even seemingly benign content types can deliver high-impact attacks. #CyberDudeBivash #CVE2025 #AppleSecurity #ZeroDay #ImageIO #MemoryCorruption #CyberThreatIntel #PatchNow #iOSSecurity #macOSSecurity #ThreatIntel #ZeroTrust read the full article on - https://lnkd.in/ewbEBFcP

Adversaries are evolving their tactics by utilizing legitimate tools such as Impacket to maneuver undetected across networks, blending into the normal traffic flow. This method, known as "living off the land," poses significant challenges for security teams as malicious activities like commands and file transfers remain concealed within encrypted east-west traffic. Learn more about detecting Impacket's stealthy lateral movements in the article: [How to Detect Impacket's Hidden Lateral Movement East-West](https://lnkd.in/gWfkpx63).

From SD-WAN to Zero Trust, today’s IT environments demand proof, not assumptions. Spirent Communications CyberFlood lets you test with real traffic at scale — validating performance, scalability, and security against real-world conditions. ✅ Stress-test up to 400G ✅ Validate VPN & ZTNA policies ✅ Simulate real apps, attacks & GenAI traffic Turn uncertainty into confidence with results you can trust. 🔗 Learn more: https://zurl.co/gPCy1 #Spirent #CyberFlood #NetworkTesting #SecurityValidation #AlJammazTechnologies

Adams explained that the Russian threat actors employ a multi-faceted approach: First, they exploit the unpatched CVE-2018-0171 vulnerability. Following a successful breach, they conduct network reconnaissance, focusing on industrial control system protocols. They also utilize sophisticated post-exploitation tools, such as custom SNMP tooling for persistence and the SYNful Knock firmware implant, to maintain covert access and evade detection for extended periods. https://lnkd.in/dRePswfM