ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploitation and MCP Abuse
Summary
The weekly roundup covers The Gentlemen RaaS’s FortiGate exploitation, BMC FootPrints flaws enabling pre-authentication RCE, malware and phishing campaigns, CursorJack MCP abuse, and findings on exploited vulnerabilities and exposed GitHub secrets.
Key points
- Group-IB reports that The Gentlemen RaaS exploits CVE-2024-55591 and tracks about 14,700 exploited FortiGate devices plus 969 validated brute-forced VPN credentials; it says 94 organizations have been attacked.
- Four BMC FootPrints flaws can be chained for pre-authentication RCE through a guest token and Java deserialization; the issues were addressed in September 2025.
- Hijack Loader is delivering SnappyClient, which supports screenshots, keylogging and data theft, and updated ACRStealer variants; reported evasion methods include AMSI bypasses and direct system calls.
- Proofpoint describes CursorJack, which abuses Cursor MCP deep links: social engineering and user acceptance of an install prompt can enable local command execution or installation of a remote MCP server.
- Reported phishing campaigns use Microsoft Teams Quick Assist to seek remote access, LiveChat refund lures to collect credentials and MFA codes, and ClickFix instructions to deliver an AutoHotKey backdoor.
- DJI patched a backend flaw that researcher Sammy Azdoufal said allowed device data to be accessed using serial numbers without authentication; he reported mapping more than 7,000 Romo vacuums and 3,000 power stations.
- VulnCheck says about 1% of 2025 CVEs were exploited in the wild by year-end; GitGuardian reports 28.6 million new secrets in public GitHub commits in 2025, up 34% year over year.
Article Details
- Event Type
- Multi-topic cybersecurity threat bulletin covering ransomware, vulnerability exploitation, malware delivery, phishing, and security incidents.
- Impact
- The reported activity includes The Gentlemen's exploitation of FortiGate devices and attacks on about 94 organizations; pre-authentication remote code execution flaws in BMC FootPrints; active exploitation attempts against Citrix NetScaler; and campaigns seeking remote access, credentials, financial information, or data theft. DJI patched a backend flaw that a researcher said exposed data from thousands of devices.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | wasafaisalabad[.]gop[.]pk | Pakistani government website reported as compromised and used to deliver fake CAPTCHA lures in a ClickFix-style payload-delivery campaign. |
MITRE ATT&CK
T1056.001 · KeyloggingSnappyClient is reported to include keylogging capabilities.T1110 · Brute ForceThe Gentlemen reportedly maintains validated FortiGate VPN credentials obtained through brute force.T1190 · Exploit Public-Facing ApplicationThe article reports exploitation of vulnerabilities in internet-facing FortiGate devices, BMC FootPrints, and Citrix NetScaler.T1204.001 · Malicious LinkThe reported campaigns rely on users visiting phishing links or accepting a Cursor MCP installation prompt to initiate malicious activity.T1219 · Remote Access ToolsRapid7 reports that Teams phishing campaigns persuade users to launch Quick Assist, granting threat actors remote access.T1562.001 · Disable or Modify ToolsThe Gentlemen reportedly uses a vulnerable driver to terminate security processes, impairing defenses.T1566.002 · Spearphishing LinkThe article describes phishing campaigns using links, including spear-phishing emails attributed to the suspected RagaSerpent cluster.
CVE
CVE-2023-4966Citrix · NetScaler ADC; Citrix · NetScaler GatewayA new campaign is actively targeting known security flaws in Citrix NetScaler (CVE-2025-5777 and CVE-2023-4966).CVE-2024-55591Fortinet · FortiOS; Fortinet · FortiProxyThe Gentlemen RaaS exploits CVE-2024-55591 in FortiOS/FortiProxy and maintains ~14,700 exploited FortiGate devices plus 969 bruteâforced VPN credentials.CVE-2025-5777NetScaler · ADC; NetScaler · GatewayA new campaign is actively targeting known security flaws in Citrix NetScaler (CVE-2025-5777 and CVE-2023-4966).CVE-2025-71257BMC Software, Inc. · FootPrintsBMC FootPrints contains a preâauth RCE chain (CVE-2025-71257–71260) that leverages an extracted SEC_TOKEN and Java deserialization to write files to Tomcat.CVE-2025-71258BMC Software, Inc. · FootPrintsFour security flaws (CVE-2025-71257, CVE-2025-71258, CVE-2025-71259, and CVE-2025-71260) have been disclosed in BMC FootPrints, a widely deployed ITSM solution, that could be chained into pre-authentication remote codeCVE-2025-71259BMC Software, Inc. · FootPrintsFour security flaws (CVE-2025-71257, CVE-2025-71258, CVE-2025-71259, and CVE-2025-71260) have been disclosed in BMC FootPrints, a widely deployed ITSM solution, that could be chained into pre-authentication remote codeCVE-2025-71260BMC Software, Inc. · FootPrintsFour security flaws (CVE-2025-71257, CVE-2025-71258, CVE-2025-71259, and CVE-2025-71260) have been disclosed in BMC FootPrints, a widely deployed ITSM solution, that could be chained into pre-authentication remote code
People
Threat Actors
APT28The article reports that Russia’s APT28 group has adopted the ClickFix social-engineering tactic.hastalamuerteIdentified in the article as the operator of The Gentlemen, who opened a public arbitration thread accusing Qilin operators of withholding affiliate commission.LazarusThe article reports that North Korea’s Lazarus group has adopted the ClickFix social-engineering tactic.MuddyWaterThe article reports that Iran’s MuddyWater group has adopted the ClickFix social-engineering tactic.RagaSerpentA SideWinder-adjacent cluster suspected of using tax-audit and government-compliance spear-phishing to deliver malware and establish sustained access in targeted organizations.The GentlemenGroup-IB describes this nascent Ransomware-as-a-Service operation as exploiting CVE-2024-55591 in FortiOS/FortiProxy and reports that it has attacked about 94 organizations since emerging in July/August 2025.
Malware
ACRStealerHijack Loader is delivering SnappyClient and updated ACRStealer variants with AMSI bypasses, Heaven’s Gate, direct syscalls, and cryptoâtheft capabilities.Hijack LoaderHijack Loader is delivering SnappyClient and updated ACRStealer variants with AMSI bypasses, Heaven’s Gate, direct syscalls, and cryptoâtheft capabilities.RhadamanthysWider trends include mass exploitation attempts against Citrix NetScaler, AOTâcompiled malware evading analysis (Rhadamanthys/XMRig), GitHub secrets sprawl, and expanded APT operations like RagaSerpent.SnappyClientHijack Loader is delivering SnappyClient and updated ACRStealer variants with AMSI bypasses, Heaven’s Gate, direct syscalls, and cryptoâtheft capabilities.XMRigWider trends include mass exploitation attempts against Citrix NetScaler, AOTâcompiled malware evading analysis (Rhadamanthys/XMRig), GitHub secrets sprawl, and expanded APT operations like RagaSerpent.
Vendors
DJIDJI has patched a security flaw in its backend that could have allowed attackers to take over all its Romo smart vacuums.GoogleGoogle blocks millions of risky appsMicrosoftRapid7 said it’s seeing an increase in phishing campaigns where threat actors impersonate internal IT departments via Microsoft Teams.
Products
BMC FootPrintsBMC FootPrints contains a preâauth RCE chain (CVE-2025-71257–71260) that leverages an extracted SEC_TOKEN and Java deserialization to write files to Tomcat.Citrix NetScalerWider trends include mass exploitation attempts against Citrix NetScaler, AOTâcompiled malware evading analysis (Rhadamanthys/XMRig), GitHub secrets sprawl, and expanded APT operations like RagaSerpent.CursorProofpoint has detailed a new technique called CursorJack that abuses Cursor’s support for Model Context Protocol (MCP) deep links to enable local command execution or allow installation of a malicious remote MCP server.Fortinet FortiGatehighlights a steady stream of lowânoise but highâimpact operations — from a nascent RaaS exploiting FortiGate devices to stealthy loaders, advanced evasion tricks, and refined phishing campaigns.FortiOSThe Gentlemen RaaS exploits CVE-2024-55591 in FortiOS/FortiProxy and maintains ~14,700 exploited FortiGate devices plus 969 bruteâforced VPN credentials.FortiProxyThe Gentlemen RaaS exploits CVE-2024-55591 in FortiOS/FortiProxy and maintains ~14,700 exploited FortiGate devices plus 969 bruteâforced VPN credentials.LiveChatNew socialâengineering and abuse techniques include CursorJack deepâlink command execution, Teams Quick Assist scams for remote access, and LiveChat refund phishing to steal credentials and MFA codes.Microsoft Quick AssistNew socialâengineering and abuse techniques include CursorJack deepâlink command execution, Teams Quick Assist scams for remote access, and LiveChat refund phishing to steal credentials and MFA codes.Microsoft TeamsRapid7 said it’s seeing an increase in phishing campaigns where threat actors impersonate internal IT departments via Microsoft Teams.RomoDJI has patched a security flaw in its backend that could have allowed attackers to take over all its Romo smart vacuums.
Countries
IndiaThe attack chain is consistent with a prior campaign targeting India using similar tax-related lures to deliver a legitimate enterprise tool called SyncFuture TSM, developed by a Chinese company.Indonesia(C2) and establish sustained access across targeted organizations in Southeast Asia, including Indonesia and Thailand.Thailandand establish sustained access across targeted organizations in Southeast Asia, including Indonesia and Thailand.