Exposed Server Reveals RedGolf-Linked Fortinet Exploits and Shiseido Reconnaissance
Summary
A briefly exposed server linked to KeyPlug and RedGolf/APT41 contained Fortinet exploit scripts, a PHP webshell, reverse-shell tools, and reconnaissance files listing Shiseido-related domains and authentication portals.
Key points
- The server at 45.77.34[.]88 was exposed for less than 24 hours; a captured snapshot preserved its files after direct access was no longer possible.
- The infrastructure was linked to KeyPlug activity and attributed to RedGolf, which the article says overlaps with APT41.
- Reconnaissance files listed nearly 100 Shiseido-related domains, including login portals, development environments, internal dashboards, and identity providers.
- A script fingerprinted Fortinet VPN and firewall login portals and gathered version-related JavaScript hashes.
- Exploit scripts targeted FortiOS WebSocket CLI endpoints associated with CVE-2024-23108 and CVE-2024-23109, attempting unauthenticated privileged commands.
- The directory included an encrypted PHP webshell and a PowerShell TCP reverse shell, plus an ELF listener for managing sessions.
- The article provides network and file-hash indicators and recommends monitoring for suspicious requests to Fortinet login and WebSocket CLI paths.
Article Details
- Attack Vectors
- Fortinet reconnaissance scripts identify live VPN and firewall login portals and collect version-specific JavaScript hashes to fingerprint appliances and assess exploit compatibility.
- Scripts ws_test.py, test.py, and ws_tests.py target FortiOS WebSocket CLI endpoints, spoof local traffic with a Forwarded header, and attempt unauthenticated privileged CLI access associated with CVE-2024-23108 and CVE-2024-23109.
- The bx.php PHP webshell accepts encrypted HTTP POST payloads, decrypts them using AES-128 or a fallback XOR/base64 routine, and executes commands dynamically in memory.
- client.ps1 establishes an encrypted TCP reverse-shell connection to 45.77.34[.]88:8080, executes received PowerShell commands, and returns encrypted output.
- The Server ELF binary listens for HTTP-based operator commands on port 8080 and manages sessions.
- Reconnaissance scripts enumerate Shiseido-related domains, identify origin IPs, and check for assets lacking common CDN headers.
- Defensive Notes
- Patch Fortinet SSL VPN interfaces and run supported versions, particularly on internet-exposed appliances.
- Monitor for repeated or automated requests to /remote/login and /login, including requests with consistent User-Agent strings that do not proceed through authentication.
- Review historical proxy and firewall logs for WebSocket handshakes to /ws/newcli/open and /ws/cli/open, and for crafted identity strings such as admin, root, and super_admin.
- Monitor the listed IP addresses and file hashes as reported indicators, and investigate unexpected TCP connections to port 8080.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | combinechina[.]com | Domain listed alongside RedGolf open-directory infrastructure. |
| IPV4 | 108[.]160[.]129[.]175 | Listed as a RedGolf open-directory network observable. |
| IPV4 | 154[.]31[.]217[.]200 | RedGolf-attributed server associated with KeyPlug infrastructure and exposed tooling. |
| IPV4 | 185[.]82[.]219[.]201 | Listed as a RedGolf open-directory network observable. |
| IPV4 | 45[.]32[.]21[.]176 | Listed as a RedGolf open-directory network observable. |
| IPV4 | 45[.]77[.]249[.]100 | Listed as a RedGolf open-directory network observable. |
| IPV4 | 45[.]77[.]34[.]88 | Exposed staging server hosting attacker tools; also used as the client.ps1 reverse-shell controller. |
| IPV4 | 66[.]42[.]55[.]203 | Listed as a RedGolf open-directory network observable. |
| SHA256 | 09b220a315ea0aebae2de835a3240d3690c962a3c801dd1c1cf6e6e2c84ede95 | Hash of 1.py, a Fortinet reconnaissance script. |
| SHA256 | 2386baf4bf3a57ae7bca44c952855a98edf569da7b62bb0c8cbe414f1800d2b6 | Hash of script.py, a CDN fingerprinting script recovered from the exposed directory. |
| SHA256 | 53a24e00ae671879ea3677a29ee1b10706aa5aa0dccd4697c3a94ee05df2ec45 | Hash of a malicious ELF sample exhibiting backdoor functionality. |
| SHA256 | 7146774db3c77e27b7eb48745aef56b50e0e7d87280fea03fa6890646af50d50 | Hash of bx.php, an obfuscated command-execution webshell. |
| SHA256 | 98261d1f92ae8f7a479bc5fc4d0a8d6a76c0d534e63e9edbc2d6257a9ba84b9d | Hash of ws_test.py, Fortinet WebSocket exploitation code. |
| SHA256 | c1da6449513844277acc969aae853a502f177e92f98d37544f94a8987e6e2308 | Hash of a Linux-based reverse-shell artifact. |
| SHA256 | c8d2b2ba5b6585584200ca46564b47db8048d748aefbdfe537bceaf27fb93ad7 | Hash of client.ps1, a PowerShell reverse shell. |
| SHA256 | e82ecbe3823046a27d8c39cc0a4acb498f415549946c9ff0e241838b34ed5a21 | Hash of fscan, a port-scanning and service-enumeration tool present in the exposed directory. |
| SHA256 | f21a7180405c52565fdc7a81b2fb5a494a3d936a25d1b30b9bd4b69a5e1de9a3 | Hash of Server, an HTTP-based session-control binary. |
MITRE ATT&CK
T1059.001 · PowerShellclient.ps1 executes received commands using PowerShell Invoke-Expression.T1071.001 · Web ProtocolsThe bx.php webshell receives command payloads over HTTP POST.T1095 · Non-Application Layer Protocolclient.ps1 communicates with its controller over raw TCP port 8080.T1190 · Exploit Public-Facing ApplicationThe Fortinet WebSocket scripts attempt unauthenticated exploitation of FortiOS endpoints associated with CVE-2024-23108 and CVE-2024-23109.T1505.003 · Web Shellbx.php is a PHP webshell that receives encrypted commands and executes them on the server.T1573 · Encrypted ChannelThe webshell encrypts command payloads with AES-128 or XOR, while client.ps1 encrypts TCP tasking and responses with AES-128 ECB.T1595 · Active ScanningScripts scan domains and Fortinet appliances to identify live portals, services, and exposed origin IPs.
CVE
CVE-2024-23108ws_test.py closely mirrors public exploitation techniques for CVE-2024-23108 and CVE-2024-23109, originally documented by WatchTowr, which abuse unauthenticated WebSocket endpoints in FortiOS to execute privileged CLICVE-2024-23109ws_test.py closely mirrors public exploitation techniques for CVE-2024-23108 and CVE-2024-23109, originally documented by WatchTowr, which abuse unauthenticated WebSocket endpoints in FortiOS to execute privileged CLI
People
Threat Actors
Malware
Vendors
Products
FortiClientThe following logic is used to extract the hash from the FortiClient portal:FortiOSlogin.js path typically varies across FortiOS versions and can be used to infer the software build in use. Identifying these values allows operators to align follow-on actions with known vulnerable versions orKeycloakand regions. The file included domains hosted in Singapore and across Europe, including Okta and Keycloak portals, staging environments, and data protection services. This suggests a focus on authenticationOkta120 countries and regions. The file included domains hosted in Singapore and across Europe, including Okta and Keycloak portals, staging environments, and data protection services. This suggests a focus on
Tools
1.py1.py - Fortinet Reconnaissance Scriptbx.phpbx.php - Encrypted POST-Based Webshell for Remote Command Executionclient.ps1Figure 6: bx.php script contents.client.ps1 - PowerShell Reverse Shell Over TCPfscanawvs/ folder, alongside a copy of fscan-a publicly available tool used for port scanning and service enumeration. The file lists close to one hundred Shiseido domains, many of which point to login portals, developmentscript.pyan effort to surface infrastructure directly reachable for follow-on targeting. The presence of script.py, a CDN fingerprinting tool discussed in the next section, reinforces this behavior.test.pytest.py andws_test.pyws_test.py - Automated Exploitation of Fortinet WebSocket CLI Accessws_tests.pyws_tests.py-automates exploitation of Fortinet's WebSocket-based CLI endpoints.