#1388 · [Fortinet] FortiGuard Weekly Newsletter

ID interno: 10918000000457551

← Volver al listado

Estado

Cancelada

Prioridad

Normal

Urgencia

Alta

Impacto

Afecta al usuario

Categoría

Business Central

Subcategoría

Others

Tipo

Incidencia

Canal

CAU

SLA

Grupo

Brownie (HQ)

Site

HQ

Nivel

Nivel 1 - Primera Respuesta

Solicitante

Fortinet

Técnico

Edwin Martinez

Departamento

Request Type

Incidencia

Creado

15/10/22, 3:56

Resuelto

Actualizado

15/10/22, 6:23

Asignado

Oct 15, 2022 08:23 AM

Respondido

Completado

First resp. due

Due by

Tiempo de resolución

Overdue

No

First resp. overdue

No

Escalado

No

Reabierto

No

FCR

No

Solicitada cancelación

No

Service Request

No

Trashed

No

Asignar técnico

Actual: Edwin Martinez

Descripción

 

View this article online

 

Activity Summary - Week Ending Oct 14, 2022

 

CISA Advisory on Vulnerabilities Actively Exploited By Threat Actors Supported by China - On October 6, 2022, the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation (FBI) released a joint advisory that listed the most exploited vulnerabilities by threat actors sponsored by China since 2020. The list included 20 vulnerabilities across 13 vendors that were used against the U.S. and its allies.

This is significant because the list contains vulnerabilities that have been known to be exploited by Chinese threat actors. Patches and workarounds should be applied to the vulnerabilities as soon as possible.

[Continue reading]

 

Top 5 Application Vulnerabilities / IPS

Rank

Name

%

1 D-Link.Devices.HNAP.SOAPAction-Header.Command.Execution 21
2 Generic.XXE.Detection 21
3 PHPUnit.Eval-stdin.PHP.Remote.Code.Execution 20
4 TCP.Split.Handshake 20
5 ThinkPHP.Controller.Parameter.Remote.Code.Execution 19

 

Ukrainian Military-Themed Excel File Delivers Multi-Stage Cobalt Strike Loader – FortiGuard Labs has observed an increasing number of campaigns targeting both sides of the ongoing Russian-Ukrainian conflict. There may be a cyber element to the conflict or just opportunistic threat actors taking advantage of the war to further their malicious objectives.

We recently encountered a malicious Excel document masquerading as a tool that calculates salaries for Ukrainian military personnel. This article discusses the technical details of the document that executes evasive multi-stage loaders when triggered, eventually uploading the Cobalt Strike Beacon malware onto the victim's device.

[Continue reading]

Signatures:
VBA/Agent.CSW!tr
MSIL/Agent.FGLT!tr.dldr
MSIL/Agent.FGLT!tr
W32/Cobalt.FGLT!tr
Data/Agent.FGLT!tr

Indicator(s):
Files
4cedec3e1a2f72a917ad9a59ebe116ed50c3268567946d1e493c8163486b888b (XLSM)
c0c455cd3e18be14d2e34cf4e3fb98e7ab0a75ef04b6049ff9f7b306d62704b8 (1st stage downloader - fhasbqwn[.]dll)
2927794d7c550c07303199752b8226f197d7ef497d04cf038859f95b60edc9ce (JPEG with encrypted payload overlay)
b03c9f7823810e3eeef3c0b1d6c00da4f16fdc2ced92f97f78e5676d0989d9b3 (2nd stage loader - sdafsfdpieowrfb[.]exe)
de8c789ef2e1da81182a7529e7b42adf2984cd6e70b02e60fd770ebe658086ae (Cobalt Strike loader)

Filenames
%Temp%\jdbsabdqbsmnqwdssad[.]lnk
%AppData%\Microsoft\fhasbqwn[.]dll

Excel Document Delivers Multiple Malware by Exploiting CVE-2017-11882 – Part II – FortiGuard Labs recently captured an Excel document with an embedded malicious file in the wild. The embedded file, with a randomized file name, exploits vulnerability CVE-2017-11882 to execute malicious code, delivering and executing malware on a victim's device. Part I of my analysis explains how this crafted Excel document exploits CVE-2017-11882, and what it does when it's exploiting that vulnerability. An involved website (hxxp[:]//lutanedukasi[.]co[.]id/wp-includes/) was found storing and delivering numerous malware family samples, like Formbook and Redline. Redline, also known as Redline Stealer, is a commercial malware family designed to collect sensitive information from infected devices, such as saved credentials, autocomplete data, credit card information, and more.

In part II of the analysis, a Redline sample collected from the same website is examined. In this report, you will learn how the Redline payload is extracted from the sample, how it maintains persistence on the infected device, the types of sensitive information stolen from the victim's device, and how that stolen information is submitted to its C2 server.

[Continue reading]

Signatures: MSIL/Redline.8B8C!tr

Indicator(s):
hxxp://lutanedukasi[.]co[.]id/wp-includes/almac[.]exe
sinmac[.]duckdns[.]org:2267 - Redline C2 Server
D1EA94C241E00E8E59A7212F30A9117393F9E883D2B509E566505BC337C473E3 - GAT412-IFF22[.]xlsx
9D621005649A185E07D44EC7906530B8269DF0A84587DEB3AAC8707C5DD88B8C - Redline, almac[.]exe

 

Top 5 Malware Activity

Rank

Name

%

1 W32/Alllu.A!tr 38
2 W32/Inject.ZYD!tr 17
3 W32/VBNA.HLT!worm 17
4 W32/Flystud.RN!tr 15
5 W32/Agent.BMGF!tr.dldr 14

 

LilithBot Sold as Malware-as-a-Service (MaaS) – FortiGuard Labs is aware of a report in which the LilithBot malware is being sold as Malware-as-a-Service (MaaS) by a group called "Eternity". LilithBot is a multi-functional malware that can act as infostealer, cryptominer, and clipper. LilithBot is a malware variant that is being sold by the Eternity group and has built-in functionalities that contain the following:

  • Infostealer that collects pictures and information from browsers.
  • It uploads collected information to its C2 servers.
  • Cryptominer that mines Monero (XMR) cryptocurrency.
  • Clipper that monitors a user's clipboard and replaces user's crypto addresses with the attacker's addresses.

[Continue reading]

Signatures:
MSIL/Agent.AES!tr.spy
W64/GenKryptik.FQTL!tr

Maggie: New Backdoor Targeting Microsoft SQL Servers – FortiGuard Labs is aware of reports that highlight a new backdoor called "Maggie" that targets Microsoft SQL servers. Maggie connects to Command and Control (C2) servers for remote commands and supports a variety of commands such as downloading, executing, and deleting files. It propagates to other SQL servers through bruteforcing, as well as unknown exploit commands. Based on external reports, most infected Microsoft SQL servers are in Asia.

[Continue reading]

Signatures:
W64/JuicyPotato.AI!tr
Riskware/Inject.HEUR!tr.pws

Endpoint Detection and Response

Threat Coverage: How FortiEDR protects against RaspberryRobin malware – RaspberryRobin is a worm transferred via USB drive that connects to primarily external QNAP devices (C2) to download and execute malicious payloads. This worm uses msiexec.exe to connect to its C2 server using an HTTP request, downloading and executing malicious msi packages. Activity associated with this worm's behavior was first publicly reported in September 2022 . There is currently no clear indication which group is responsible for the creation or distribution of this worm, although its use has been linked to SocGholish's fake update campaigns from earlier this year. In this article, an in-depth analysis of the malware is provided, including how EDR can protect against such a threat.

[Continue reading]

Indicator(s):
Raspberry Robin sample - 503620130e7d59853f7ba2119c9b410f0fe346ec
Raspberry Robin sample - 5506fc14acac1dc841abff2b972c972f3f1722ec
Raspberry Robin sample - D92379ee6065391d06cb218dd0d713aa0e7b7942
Raspberry Robin sample - 008945cc473304fe2ad7aa4af6b14a120e6703b2
MSI file - 3b552f77179299d3a3df06b3f687eb91013d46bb
DLL file - bfcfa72ba5095fba108314c1c4deb5faed82ef4d
Malicious URL - hxxp://as3[.]biz:8080/vs1cn41zizo
Malicious URL - hxxp://ej3[.]xyz:8080/xj92yfgkob
Malicious URL - hxxp://5jb[.]me:8080/yyyod4/bxxdil5hpau4ehelvzzfjewbwxuu0/xvklbocc
Malicious URL - hxxp://w4[.]nz:8080/a/rb/zq3n3i36pkkkgouu6k

 

Validate your network's security accuracy, application usage and performance with a Fortinet Cyber Threat Assessment.

Request Assessment »


www.fortinet.com

Questions? Contact Us

 
 
 
 
 

You received this email because you are subscribed to Weekly FortiGuard Update from Fortinet, Inc. This email was sent to soporte@browniespain.com. To unsubscribe please update the subscription settings in your support account

JSON crudo (detalle completo)
{
  "id": "10918000000457551",
  "sla": null,
  "mode": {
    "id": "10918000000168268",
    "name": "CAU",
    "internal_name": "CAU"
  },
  "site": {
    "id": "10918000000794001",
    "name": "HQ",
    "deleted": false,
    "is_default": true
  },
  "tags": [],
  "group": {
    "id": "10918000000199875",
    "name": "Brownie (HQ)",
    "site": {
      "id": "10918000000794001"
    },
    "deleted": false
  },
  "level": {
    "id": "10918000000168252",
    "name": "Nivel 1 - Primera Respuesta"
  },
  "assets": [],
  "impact": {
    "id": "10918000000009652",
    "name": "Afecta al usuario"
  },
  "is_fcr": false,
  "status": {
    "id": "10918000000085001",
    "name": "Cancelada",
    "color": "#cacaca",
    "stop_timer": false,
    "in_progress": false,
    "internal_name": "Canceled"
  },
  "is_read": true,
  "subject": "[Fortinet] FortiGuard Weekly Newsletter",
  "urgency": {
    "id": "10918000000009529",
    "name": "Alta"
  },
  "category": {
    "id": "10918000000406266",
    "name": "Business Central",
    "deleted": false
  },
  "email_cc": [],
  "email_to": [
    "soporte@browniespain.com"
  ],
  "priority": {
    "id": "10918000000008169",
    "name": "Normal",
    "color": "#006600"
  },
  "template": {
    "id": "10918000000008023",
    "name": "Incidencia",
    "image": "incident-icon",
    "layouts": [
      {
        "id": "10918000000102032",
        "name": "requester_layout"
      },
      {
        "id": "10918000000102034",
        "name": "technician_layout"
      }
    ],
    "comments": "Interrupción o reducción de la calidad no planificada del Servicio",
    "inactive": false,
    "workflow": null,
    "has_tasks": false,
    "lifecycle": {
      "id": "10918000000183026",
      "name": "Ciclo de vida de una Solicitud",
      "inactive": false,
      "is_published": true
    },
    "checklists": [],
    "created_by": {
      "id": "10918000000007977",
      "name": "System",
      "site": null,
      "phone": null,
      "mobile": null,
      "email_id": null,
      "sms_mail": null,
      "job_title": "",
      "last_name": "",
      "photo_url": "https://profile.zoho.eu/file?exp=10&ID=-1&t=user&height=60&width=60",
      "department": null,
      "first_name": "System",
      "user_scope": "internal_user",
      "employee_id": "",
      "is_vip_user": false,
      "sms_mail_id": null,
      "cost_per_hour": null,
      "is_technician": false
    },
    "is_default": true,
    "sort_index": "1",
    "user_groups": [],
    "created_time": {
      "value": "1169631000000",
      "display_value": "Jan 24, 2007 10:30 AM"
    },
    "has_checklists": false,
    "has_user_group": false,
    "support_groups": [],
    "template_fields": [
      {
        "name": "email_ids_to_notify",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "attachments",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "request_type",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": false,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "subject",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": true,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "description",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "responded_time",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "mode",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": false,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "assets",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "urgency",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": false,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "group",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": false,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "requester",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": true,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "created_time",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "level",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": false,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "resolution.content",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": false,
            "scope_name": "requester_can_view"
          },
          {
            "value": false,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "impact",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": false,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "technician",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": false,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "priority",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": false,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "due_by_time",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "first_response_due_by_time",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "site",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "completed_time",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "udf_fields.udf_char3",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "udf_fields.udf_char2",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": false,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "category",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "subcategory",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "status",
        "layout": {
          "name": "technician_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": false,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "email_ids_to_notify",
        "layout": {
          "name": "requester_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "attachments",
        "layout": {
          "name": "requester_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "subject",
        "layout": {
          "name": "requester_layout"
        },
        "scopings": [
          {
            "value": true,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "description",
        "layout": {
          "name": "requester_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "responded_time",
        "layout": {
          "name": "requester_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "assets",
        "layout": {
          "name": "requester_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "requester",
        "layout": {
          "name": "requester_layout"
        },
        "scopings": [
          {
            "value": true,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "created_time",
        "layout": {
          "name": "requester_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "due_by_time",
        "layout": {
          "name": "requester_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "first_response_due_by_time",
        "layout": {
          "name": "requester_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "site",
        "layout": {
          "name": "requester_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "completed_time",
        "layout": {
          "name": "requester_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "udf_fields.udf_char3",
        "layout": {
          "name": "requester_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "category",
        "layout": {
          "name": "requester_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      },
      {
        "name": "subcategory",
        "layout": {
          "name": "requester_layout"
        },
        "scopings": [
          {
            "value": false,
            "scope_name": "mandatory"
          },
          {
            "value": true,
            "scope_name": "requester_can_view"
          },
          {
            "value": true,
            "scope_name": "requester_can_edit"
          }
        ]
      }
    ],
    "service_category": null,
    "last_updated_time": {
      "value": "1747822830943",
      "display_value": "May 21, 2025 12:20 PM"
    },
    "show_to_requester": true,
    "task_configuration": {
      "trigger_after_approved": false,
      "trigger_after_creation": false,
      "allow_requester_to_view": false,
      "allow_requester_to_select": false
    },
    "is_service_template": false,
    "reference_templates": []
  },
  "workflow": null,
  "email_bcc": [],
  "has_draft": false,
  "has_notes": false,
  "lifecycle": {
    "id": "10918000000183026",
    "name": "Ciclo de vida de una Solicitud",
    "inactive": false,
    "is_published": true
  },
  "requester": {
    "id": "10918000000258315",
    "name": "Fortinet",
    "site": {
      "id": "10918000000794001",
      "name": "HQ",
      "deleted": false,
      "is_default": true
    },
    "phone": null,
    "mobile": null,
    "email_id": "noreply@fortinetpm.com",
    "sms_mail": null,
    "job_title": null,
    "last_name": null,
    "photo_url": "https://profile.zoho.eu/file?exp=10&ID=-1&t=user&height=60&width=60",
    "department": null,
    "first_name": "Fortinet",
    "user_scope": "internal_user",
    "employee_id": null,
    "is_vip_user": false,
    "sms_mail_id": null,
    "cost_per_hour": null,
    "is_technician": false
  },
  "created_by": {
    "id": "10918000000007977",
    "name": "System",
    "site": null,
    "phone": null,
    "mobile": null,
    "email_id": null,
    "sms_mail": null,
    "job_title": "",
    "last_name": "",
    "photo_url": "https://profile.zoho.eu/file?exp=10&ID=-1&t=user&height=60&width=60",
    "department": null,
    "first_name": "System",
    "user_scope": "internal_user",
    "employee_id": "",
    "is_vip_user": false,
    "sms_mail_id": null,
    "cost_per_hour": null,
    "is_technician": false
  },
  "department": null,
  "display_id": "1388",
  "is_overdue": false,
  "is_trashed": false,
  "message_id": "<80222e83e109fc47effc1dd016338283@swift.generated>",
  "resolution": null,
  "technician": {
    "id": "10918000000167018",
    "name": "Edwin Martinez",
    "site": {
      "id": "10918000000794001"
    },
    "phone": null,
    "mobile": "680658288",
    "email_id": "edwin.martinez@browniespain.com",
    "sms_mail": null,
    "job_title": "Retail Project Operations",
    "last_name": "Martinez",
    "photo_url": "https://profile.zoho.eu/file?exp=10&ID=20083566992&t=user&height=60&width=60",
    "department": {
      "id": "10918000000174683"
    },
    "first_name": "Edwin",
    "user_scope": "internal_user",
    "employee_id": "emartinez",
    "is_vip_user": false,
    "sms_mail_id": null,
    "cost_per_hour": null,
    "is_technician": false
  },
  "udf_fields": {
    "udf_char2": "Remoto",
    "udf_char3": null
  },
  "attachments": [],
  "description": "     <div style=\"width: 100%; min-width: 100%; color: rgb(10, 10, 10); font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; font-family: Arial\" class=\" zm_4974798930542876975_parse_8857626238755921953\"> <table class=\"x_-1464192363body\" style=\"border-spacing: 0; border-collapse: collapse; vertical-align: top; background: rgb(243, 243, 243); height: 100%; width: 100%; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3\"> <tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"> <td class=\"x_-1464192363float-center\" align=\"center\" valign=\"top\" style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; font-size: 16px; line-height: 1.3; margin: 0 auto; Margin: 0 auto; float: none; text-align: center\"> <center style=\"width: 100%; min-width: 580px\"> <table class=\"x_-1464192363float-center x_-1464192363container\" align=\"center\" style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; background: rgb(254, 254, 254); width: 580px; margin: 0 auto; Margin: 0 auto; float: none; text-align: center\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3\"> <table id=\"x_-1464192363logo\" class=\"x_-1464192363row\" style=\"border-spacing: 0; border-collapse: collapse; vertical-align: top; text-align: left; padding: 0; width: 100%; display: table; background-color: rgb(49, 60, 70)\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"> <th valign=\"middle\" class=\"x_-1464192363columns x_-1464192363small-12 x_-1464192363large-12 x_-1464192363last x_-1464192363first\" style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; text-align: left; font-size: 16px; line-height: 1.3; margin: 0 auto; Margin: 0 auto; padding-bottom: 16px; width: 564px; padding-left: 16px; padding-right: 16px\"><table style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><th style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3\"> <table class=\"x_-1464192363spacer\" style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><td height=\"12px\" style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 12px; line-height: 12px\">&nbsp;</td></tr></tbody></table> <img class=\"x_-1464192363float-left\" src=\"/fg_weekly/tpl/logo.png\" width=\"114\" height=\"15\" style=\"outline: none; text-decoration: none; max-width: 100%; clear: both; display: block; float: left; text-align: left; width: 114px; height: auto\" /> </th></tr></tbody></table></th> </tr></tbody></table> <table id=\"x_-1464192363header\" class=\"x_-1464192363row x_-1464192363collapse\" style=\"border-spacing: 0; border-collapse: collapse; vertical-align: top; text-align: left; padding: 0; width: 100%; display: table\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"> <th class=\"x_-1464192363columns x_-1464192363small-12 x_-1464192363large-12 x_-1464192363last x_-1464192363first\" style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; text-align: left; font-size: 16px; line-height: 1.3; margin: 0 auto; Margin: 0 auto; padding-bottom: 16px; padding-right: 0; padding-left: 0; width: 588px\"><table style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><th style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3\"> <img class=\"x_-1464192363float-center\" src=\"/fg_weekly/tpl/header.jpg\" style=\"outline: none; text-decoration: none; width: auto; max-width: 100%; clear: both; display: block; margin: 0 auto; Margin: 0 auto; float: none; text-align: center\" /> </th></tr></tbody></table></th> </tr></tbody></table> <table id=\"x_-1464192363content\" class=\"x_-1464192363row\" style=\"border-spacing: 0; border-collapse: collapse; vertical-align: top; text-align: left; padding: 0; width: 100%; display: table\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"> <th class=\"x_-1464192363columns x_-1464192363small-12 x_-1464192363large-12 x_-1464192363last x_-1464192363first\" style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; text-align: left; font-size: 16px; line-height: 1.3; margin: 0 auto; Margin: 0 auto; padding-bottom: 16px; width: 564px; padding-left: 16px; padding-right: 16px\"><table style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><th style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3\"> <table class=\"x_-1464192363spacer\" style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><td height=\"20px\" style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 20px; line-height: 20px\">&nbsp;</td></tr></tbody></table> <p class=\"x_-1464192363text-right\" style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; text-align: right; color: rgb(82, 82, 82)\"><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"http://fortiguard.com/resources/threat-brief\" style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; color: rgb(33, 153, 232); text-decoration: none\">View this article online</a></p> <table class=\"x_-1464192363spacer\" style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><td height=\"10px\" style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 10px; line-height: 10px\">&nbsp;</td></tr></tbody></table> <div id=\"x_-1464192363doc\" style=\"\"> <h1 style=\"padding: 0; margin: 0; Margin: 0; line-height: 1.3; font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin-bottom: 10px; Margin-bottom: 10px; font-size: 20px; color: rgb(82, 82, 82); text-align: left\">Activity Summary - Week Ending Oct 14, 2022</h1> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\">&nbsp;</p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><strong>CISA Advisory on Vulnerabilities Actively Exploited By Threat Actors Supported by China</strong> - On October 6, 2022, the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation (FBI) released a joint advisory that listed the most exploited vulnerabilities by threat actors sponsored by China since 2020. The list included&nbsp;20 vulnerabilities across 13 vendors that were used against the U.S. and its allies.</p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\">This is significant because the list contains vulnerabilities that have been known to be exploited by Chinese threat actors. Patches and workarounds should be applied to the vulnerabilities as soon as possible.</p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://www.fortiguard.com/threat-signal-report/4796/cisa-advisory-on-vulnerabilities-actively-exploited-by-threat-actors-supported-by-china\" style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; color: rgb(33, 153, 232); text-decoration: none\">[Continue reading]</a></p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\">&nbsp;</p> <h2 style=\"padding: 0; margin: 0; Margin: 0; line-height: 1.3; font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin-bottom: 10px; Margin-bottom: 10px; font-size: 18px; color: rgb(82, 82, 82); text-align: left\">Top 5 Application Vulnerabilities / IPS</h2> <table style=\"padding: 0; vertical-align: top; text-align: left; width: 100%; border-collapse: collapse; border-color: grey; border-spacing: 2px; margin: 5px auto\"> <tbody> <tr style=\"padding: 0; vertical-align: top; text-align: left\"> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px; background-color: rgb(39, 83, 105)\"> <p style=\"font-family: Helvetica, Arial, sans-serif; padding: 0; margin: 0; Margin: 0; Margin-bottom: 10px; font-size: 10px; line-height: 14px; text-align: left; font-weight: normal; margin-bottom: 0; color: rgb(255, 255, 255)\"><strong>Rank</strong></p> </td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px; background-color: rgb(39, 83, 105)\"> <p style=\"font-family: Helvetica, Arial, sans-serif; padding: 0; margin: 0; Margin: 0; Margin-bottom: 10px; font-size: 10px; line-height: 14px; text-align: left; font-weight: normal; margin-bottom: 0; color: rgb(255, 255, 255)\"><strong>Name</strong></p> </td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px; background-color: rgb(39, 83, 105)\"> <p style=\"font-family: Helvetica, Arial, sans-serif; padding: 0; margin: 0; Margin: 0; Margin-bottom: 10px; font-size: 10px; line-height: 14px; text-align: left; font-weight: normal; margin-bottom: 0; color: rgb(255, 255, 255)\"><strong>%</strong></p> </td> </tr> <tr style=\"padding: 0; vertical-align: top; text-align: left; background-color: rgb(241, 241, 241)\"> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">1</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">D-Link.Devices.HNAP.SOAPAction-Header.Command.Execution</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">21</td> </tr> <tr style=\"padding: 0; vertical-align: top; text-align: left\"> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">2</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">Generic.XXE.Detection</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">21</td> </tr> <tr style=\"padding: 0; vertical-align: top; text-align: left; background-color: rgb(241, 241, 241)\"> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">3</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">PHPUnit.Eval-stdin.PHP.Remote.Code.Execution</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">20</td> </tr> <tr style=\"padding: 0; vertical-align: top; text-align: left\"> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">4</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">TCP.Split.Handshake</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">20</td> </tr> <tr style=\"padding: 0; vertical-align: top; text-align: left; background-color: rgb(241, 241, 241)\"> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">5</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">ThinkPHP.Controller.Parameter.Remote.Code.Execution</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">19</td> </tr> </tbody> </table> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\">&nbsp;</p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><strong>Ukrainian Military-Themed Excel File Delivers Multi-Stage Cobalt Strike Loader –</strong> FortiGuard Labs has observed an increasing number of campaigns targeting both&nbsp;sides of the ongoing Russian-Ukrainian conflict. There&nbsp;may be a cyber element to the conflict&nbsp;or just&nbsp;opportunistic threat actors taking advantage of the war to further their malicious objectives.</p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\">We recently encountered a malicious Excel document masquerading as a tool that&nbsp;calculates salaries for Ukrainian military personnel. This article discusses the technical details of the&nbsp;document that&nbsp;executes evasive multi-stage loaders when triggered, eventually uploading the&nbsp;Cobalt Strike Beacon malware onto the victim&#39;s device.</p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://www.fortinet.com/blog/threat-research/ukrainian-excel-file-delivers-multi-stage-cobalt-strike-loader\" style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; color: rgb(33, 153, 232); text-decoration: none\">[Continue reading]</a></p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><em>Signatures: </em><br /> <strong>VBA/Agent.CSW!tr<br /> MSIL/Agent.FGLT!tr.dldr<br /> MSIL/Agent.FGLT!tr<br /> W32/Cobalt.FGLT!tr<br /> Data/Agent.FGLT!tr</strong></p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><em>Indicator(s):<br /> Files<br /> 4cedec3e1a2f72a917ad9a59ebe116ed50c3268567946d1e493c8163486b888b (XLSM)<br /> c0c455cd3e18be14d2e34cf4e3fb98e7ab0a75ef04b6049ff9f7b306d62704b8 (1st stage downloader - fhasbqwn[.]dll)<br /> 2927794d7c550c07303199752b8226f197d7ef497d04cf038859f95b60edc9ce (JPEG with encrypted payload overlay)<br /> b03c9f7823810e3eeef3c0b1d6c00da4f16fdc2ced92f97f78e5676d0989d9b3 (2nd stage loader - sdafsfdpieowrfb[.]exe)<br /> de8c789ef2e1da81182a7529e7b42adf2984cd6e70b02e60fd770ebe658086ae (Cobalt Strike loader)<br /> <br /> Filenames<br /> %Temp%\\jdbsabdqbsmnqwdssad[.]lnk<br /> %AppData%\\Microsoft\\fhasbqwn[.]dll </em></p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><strong>Excel Document Delivers Multiple Malware by Exploiting CVE-2017-11882 – Part II –</strong> FortiGuard Labs recently captured an Excel document with an embedded malicious file in the wild. The embedded file, with a randomized file name, exploits vulnerability&nbsp;CVE-2017-11882&nbsp;to&nbsp;execute malicious code,&nbsp;delivering and executing&nbsp;malware on a victim&#39;s device. Part I of my analysis explains&nbsp;how this crafted Excel document exploits CVE-2017-11882, and&nbsp;what it does when it&#39;s exploiting that vulnerability. An involved website (hxxp[:]//lutanedukasi[.]co[.]id/wp-includes/) was found storing and delivering numerous malware family samples, like Formbook and Redline.&nbsp;Redline,&nbsp;also known as Redline Stealer,&nbsp;is a commercial malware family designed to collect sensitive information from infected devices, such as saved credentials, autocomplete data, credit card information, and more.</p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\">In part II of the analysis, a Redline sample collected from the&nbsp;same website is examined. In this report, you will learn how the Redline payload is extracted from the sample, how it maintains persistence on the infected device, the types of&nbsp;sensitive information&nbsp;stolen from the victim&#39;s device, and how that stolen information is submitted to its C2 server.</p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://www.fortinet.com/blog/threat-research/excel-document-delivers-multiple-malware-exploiting-cve-2017-11882-part-two\" style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; color: rgb(33, 153, 232); text-decoration: none\">[Continue reading]</a></p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><em>Signatures: </em><strong>MSIL/Redline.8B8C!tr</strong></p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><em>Indicator(s):<br /> hxxp://lutanedukasi[.]co[.]id/wp-includes/almac[.]exe<br /> sinmac[.]duckdns[.]org:2267 - Redline C2 Server<br /> D1EA94C241E00E8E59A7212F30A9117393F9E883D2B509E566505BC337C473E3 - GAT412-IFF22[.]xlsx<br /> 9D621005649A185E07D44EC7906530B8269DF0A84587DEB3AAC8707C5DD88B8C - Redline, almac[.]exe </em><br /> &nbsp;</p> <h2 style=\"padding: 0; margin: 0; Margin: 0; line-height: 1.3; font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin-bottom: 10px; Margin-bottom: 10px; font-size: 18px; color: rgb(82, 82, 82); text-align: left\">Top 5 Malware Activity</h2> <table style=\"padding: 0; vertical-align: top; text-align: left; width: 100%; border-collapse: collapse; border-color: grey; border-spacing: 2px; margin: 5px auto\"> <tbody> <tr style=\"padding: 0; vertical-align: top; text-align: left\"> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px; background-color: rgb(39, 83, 105)\"> <p style=\"font-family: Helvetica, Arial, sans-serif; padding: 0; margin: 0; Margin: 0; Margin-bottom: 10px; font-size: 10px; line-height: 14px; text-align: left; font-weight: normal; margin-bottom: 0; color: rgb(255, 255, 255)\"><strong>Rank</strong></p> </td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px; background-color: rgb(39, 83, 105)\"> <p style=\"font-family: Helvetica, Arial, sans-serif; padding: 0; margin: 0; Margin: 0; Margin-bottom: 10px; font-size: 10px; line-height: 14px; text-align: left; font-weight: normal; margin-bottom: 0; color: rgb(255, 255, 255)\"><strong>Name</strong></p> </td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px; background-color: rgb(39, 83, 105)\"> <p style=\"font-family: Helvetica, Arial, sans-serif; padding: 0; margin: 0; Margin: 0; Margin-bottom: 10px; font-size: 10px; line-height: 14px; text-align: left; font-weight: normal; margin-bottom: 0; color: rgb(255, 255, 255)\"><strong>%</strong></p> </td> </tr> <tr style=\"padding: 0; vertical-align: top; text-align: left; background-color: rgb(241, 241, 241)\"> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">1</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">W32/Alllu.A!tr</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">38</td> </tr> <tr style=\"padding: 0; vertical-align: top; text-align: left\"> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">2</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">W32/Inject.ZYD!tr</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">17</td> </tr> <tr style=\"padding: 0; vertical-align: top; text-align: left; background-color: rgb(241, 241, 241)\"> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">3</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">W32/VBNA.HLT!worm</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">17</td> </tr> <tr style=\"padding: 0; vertical-align: top; text-align: left\"> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">4</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">W32/Flystud.RN!tr</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">15</td> </tr> <tr style=\"padding: 0; vertical-align: top; text-align: left; background-color: rgb(241, 241, 241)\"> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">5</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">W32/Agent.BMGF!tr.dldr</td> <td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; padding: 2px\">14</td> </tr> </tbody> </table> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\">&nbsp;</p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><strong>LilithBot Sold as Malware-as-a-Service (MaaS) –</strong> FortiGuard Labs is aware of a report in which the LilithBot malware is being sold as Malware-as-a-Service (MaaS) by a group called &quot;Eternity&quot;. LilithBot is a multi-functional malware that can act as infostealer, cryptominer, and clipper. LilithBot is a malware variant that is being sold by the Eternity group&nbsp;and has built-in functionalities that contain the following:</p> <ul> <li>Infostealer that collects pictures and information from browsers.</li> <li>It&nbsp;uploads collected information to its C2 servers.</li> <li>Cryptominer that mines Monero (XMR) cryptocurrency.</li> <li>Clipper that monitors a user&#39;s clipboard and replaces user&#39;s crypto addresses with the attacker&#39;s addresses<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://www.fortiguard.com/threat-signal-report/4795/lilithbot-sold-as-malware-as-a-service-maas\" style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; color: rgb(33, 153, 232); text-decoration: none\">.</a>\n</li> </ul> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://www.fortiguard.com/threat-signal-report/4795/lilithbot-sold-as-malware-as-a-service-maas\" style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; color: rgb(33, 153, 232); text-decoration: none\">[Continue reading]</a></p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><em>Signatures: </em><br /> <strong>MSIL/Agent.AES!tr.spy<br /> W64/GenKryptik.FQTL!tr</strong></p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><strong>Maggie: New Backdoor Targeting Microsoft SQL Servers –</strong> FortiGuard Labs is aware of reports&nbsp;that highlight&nbsp;a new backdoor called &quot;Maggie&quot; that targets&nbsp;Microsoft SQL servers. Maggie connects to Command and Control (C2) servers for remote commands and supports a variety of commands such as downloading, executing, and deleting files. It propagates to other SQL servers through bruteforcing, as well as unknown exploit commands. Based on external reports, most infected Microsoft SQL servers are in Asia.</p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://www.fortiguard.com/threat-signal-report/4794/maggie-new-backdoor-targeting-microsoft-sql-servers\" style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; color: rgb(33, 153, 232); text-decoration: none\">[Continue reading]</a></p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><em>Signatures: </em><br /> <strong>W64/JuicyPotato.AI!tr<br /> Riskware/Inject.HEUR!tr.pws</strong></p> <h2 style=\"padding: 0; margin: 0; Margin: 0; line-height: 1.3; font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin-bottom: 10px; Margin-bottom: 10px; font-size: 18px; color: rgb(82, 82, 82); text-align: left\">Endpoint Detection and Response</h2> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><strong>Threat Coverage: How FortiEDR protects against RaspberryRobin malware –</strong> RaspberryRobin is a worm transferred via USB drive that connects to primarily external QNAP devices (C2) to download and execute malicious payloads. This worm uses msiexec.exe to connect to its C2 server using an HTTP request,&nbsp;downloading&nbsp;and executing&nbsp;malicious msi packages. Activity associated with this worm&#39;s behavior was first publicly reported in September 2022 . There is currently no clear indication which group is responsible for the creation or distribution of this worm, although its use has been linked to&nbsp;SocGholish&#39;s fake update campaigns from earlier this year. In this article, an in-depth analysis of the malware is provided, including how EDR can protect against such a threat.</p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://community.fortinet.com/t5/FortiEDR/Threat-Coverage-How-FortiEDR-protects-against-RaspberryRobin/ta-p/226488\" style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; color: rgb(33, 153, 232); text-decoration: none\">[Continue reading]</a></p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; color: rgb(82, 82, 82)\"><em>Indicator(s):<br /> Raspberry Robin sample - 503620130e7d59853f7ba2119c9b410f0fe346ec<br /> Raspberry Robin sample - 5506fc14acac1dc841abff2b972c972f3f1722ec<br /> Raspberry Robin sample - D92379ee6065391d06cb218dd0d713aa0e7b7942<br /> Raspberry Robin sample - 008945cc473304fe2ad7aa4af6b14a120e6703b2<br /> MSI file - 3b552f77179299d3a3df06b3f687eb91013d46bb<br /> DLL file - bfcfa72ba5095fba108314c1c4deb5faed82ef4d<br /> Malicious URL - hxxp://as3[.]biz:8080/vs1cn41zizo<br /> Malicious URL - hxxp://ej3[.]xyz:8080/xj92yfgkob<br /> Malicious URL - hxxp://5jb[.]me:8080/yyyod4/bxxdil5hpau4ehelvzzfjewbwxuu0/xvklbocc<br /> Malicious URL - hxxp://w4[.]nz:8080/a/rb/zq3n3i36pkkkgouu6k </em></p> </div> <table class=\"x_-1464192363spacer\" style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><td height=\"5px\" style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 5px; line-height: 5px\">&nbsp;</td></tr></tbody></table> <hr /> </th></tr></tbody></table></th> </tr></tbody></table> <table id=\"x_-1464192363tool\" class=\"x_-1464192363row\" style=\"border-spacing: 0; border-collapse: collapse; vertical-align: top; text-align: left; padding: 0; width: 100%; display: table\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"> <th style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; text-align: left; font-size: 16px; line-height: 1.3; margin: 0 auto; Margin: 0 auto; width: 564px; padding-left: 16px; padding-right: 16px; padding-bottom: 6px\" class=\"x_-1464192363columns x_-1464192363small-12 x_-1464192363large-12 x_-1464192363last x_-1464192363first\"><table style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><th style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3\"> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; margin-bottom: 10px; Margin-bottom: 10px; font-size: 14px; color: rgb(82, 82, 82); line-height: 20px\">Validate your network&#39;s security accuracy, application usage and performance with a <strong>Fortinet Cyber Threat Assessment</strong>.</p> <p style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; margin-bottom: 10px; Margin-bottom: 10px; font-size: 14px; color: rgb(82, 82, 82); line-height: 20px\"> <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://www.fortinet.com/ctap\" class=\"x_-1464192363link\" style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; color: rgb(220, 41, 30); text-decoration: none\">Request Assessment »</a> </p> </th></tr></tbody></table></th> </tr></tbody></table> <table id=\"x_-1464192363footer\" class=\"x_-1464192363row\" style=\"border-spacing: 0; border-collapse: collapse; vertical-align: top; text-align: left; padding: 0; width: 100%; display: table\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"> <th id=\"x_-1464192363links\" class=\"x_-1464192363columns x_-1464192363small-7 x_-1464192363large-7 x_-1464192363first\" style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; text-align: left; font-size: 16px; line-height: 1.3; margin: 0 auto; Margin: 0 auto; width: 322.3333px; padding-right: 8px; padding-left: 16px; padding-bottom: 2px\"><table style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\">\n<th style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3\"> <hr /> <table class=\"x_-1464192363row\" style=\"border-spacing: 0; border-collapse: collapse; vertical-align: top; text-align: left; padding: 0; display: table; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"> <th class=\"x_-1464192363columns x_-1464192363small-12 x_-1464192363large-3 x_-1464192363last x_-1464192363first\" style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; text-align: left; font-size: 16px; line-height: 1.3; margin: 0 auto; Margin: 0 auto; padding-left: 0; padding-right: 0; width: 25%; padding-bottom: 2px\"><table style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\">\n<th style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3\"> <p class=\"x_-1464192363text-left\" style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; text-align: left; font-size: 11px\"><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"http://www.fortinet.com\" class=\"x_-1464192363link\" style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; color: rgb(220, 41, 30); text-decoration: none\">www.fortinet.com</a></p> </th>\n<th class=\"x_-1464192363columns x_-1464192363small-12 x_-1464192363large-6 x_-1464192363last\" style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; text-align: left; font-size: 16px; line-height: 1.3; margin: 0 auto; Margin: 0 auto; padding-left: 0; padding-right: 0; width: 50%; padding-bottom: 2px\"><table style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\">\n<th style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3\"> </th>\n<th class=\"x_-1464192363columns x_-1464192363small-12 x_-1464192363large-9 x_-1464192363last x_-1464192363first\" style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; text-align: left; font-size: 16px; line-height: 1.3; margin: 0 auto; Margin: 0 auto; padding-left: 0; padding-right: 0; width: 75%; padding-bottom: 2px\"><table style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><th style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3\"> <p class=\"x_-1464192363text-right\" style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; text-align: right; font-size: 11px\">Questions? <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://www.fortinet.com/corporate/about-us/contact-us\" class=\"x_-1464192363link\" style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; color: rgb(220, 41, 30); text-decoration: none\">Contact Us</a></p> </th></tr></tbody></table></th> </tr></tbody></table></th>\n</tr></tbody></table></th>\n</tr></tbody></table> </th>\n<th class=\"x_-1464192363expander\" style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; visibility: hidden; width: 0; padding: 0\"></th>\n</tr></tbody></table></th> <th class=\"x_-1464192363columns x_-1464192363small-5 x_-1464192363large-5 x_-1464192363last\" style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; text-align: left; font-size: 16px; line-height: 1.3; margin: 0 auto; Margin: 0 auto; width: 225.6667px; padding-left: 8px; padding-right: 16px; padding-bottom: 2px\"><table style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\">\n<th style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3\"> <table class=\"x_-1464192363row\" style=\"border-spacing: 0; border-collapse: collapse; vertical-align: top; text-align: left; padding: 0; display: table; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"> <th class=\"x_-1464192363columns x_-1464192363small-2 x_-1464192363large-2 x_-1464192363first\" style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; text-align: left; font-size: 16px; line-height: 1.3; margin: 0 auto; Margin: 0 auto; padding-left: 0; padding-right: 0; width: 16.6667%; padding-bottom: 2px\"><table style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><th style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3\"> <table class=\"x_-1464192363spacer\" style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><td height=\"5px\" style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 5px; line-height: 5px\">&nbsp;</td></tr></tbody></table> <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://twitter.com/fortiguardlabs?lang=en\" style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; color: rgb(33, 153, 232); text-decoration: none\"> <img src=\"/fg_weekly/tpl/twitter.png\" style=\"outline: none; text-decoration: none; width: auto; max-width: 100%; clear: both; display: block; border: none\" /> </a> </th></tr></tbody></table></th> <th class=\"x_-1464192363columns x_-1464192363small-2 x_-1464192363large-2\" style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; text-align: left; font-size: 16px; line-height: 1.3; margin: 0 auto; Margin: 0 auto; padding-left: 0; padding-right: 0; width: 16.6667%; padding-bottom: 2px\"><table style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><th style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3\"> <table class=\"x_-1464192363spacer\" style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><td height=\"5px\" style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 5px; line-height: 5px\">&nbsp;</td></tr></tbody></table> <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://www.facebook.com/FortiGuard.Labs/\" style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; color: rgb(33, 153, 232); text-decoration: none\"> <img src=\"/fg_weekly/tpl/facebook.png\" style=\"outline: none; text-decoration: none; width: auto; max-width: 100%; clear: both; display: block; border: none\" /> </a> </th></tr></tbody></table></th> <th class=\"x_-1464192363columns x_-1464192363small-2 x_-1464192363large-2\" style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; text-align: left; font-size: 16px; line-height: 1.3; margin: 0 auto; Margin: 0 auto; padding-left: 0; padding-right: 0; width: 16.6667%; padding-bottom: 2px\"><table style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><th style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3\"> <table class=\"x_-1464192363spacer\" style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><td height=\"5px\" style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 5px; line-height: 5px\">&nbsp;</td></tr></tbody></table> <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://www.linkedin.com/showcase/fortiguard-labs/\" style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; color: rgb(33, 153, 232); text-decoration: none\"> <img src=\"/fg_weekly/tpl/linkedin.png\" style=\"outline: none; text-decoration: none; width: auto; max-width: 100%; clear: both; display: block; border: none\" /> </a> </th></tr></tbody></table></th> <th class=\"x_-1464192363columns x_-1464192363small-2 x_-1464192363large-2\" style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; text-align: left; font-size: 16px; line-height: 1.3; margin: 0 auto; Margin: 0 auto; padding-left: 0; padding-right: 0; width: 16.6667%; padding-bottom: 2px\"><table style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><th style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3\"> <table class=\"x_-1464192363spacer\" style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><td height=\"5px\" style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 5px; line-height: 5px\">&nbsp;</td></tr></tbody></table> <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://www.fortinet.com/rss-feeds.html?elqTrackId=cd78c3051ede4483b89ff39803213a04&amp;elqTrack=true\" style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; color: rgb(33, 153, 232); text-decoration: none\"> <img src=\"/fg_weekly/tpl/feed.png\" style=\"outline: none; text-decoration: none; width: auto; max-width: 100%; clear: both; display: block; border: none\" /> </a> </th></tr></tbody></table></th> <th class=\"x_-1464192363columns x_-1464192363small-2 x_-1464192363large-2 x_-1464192363last\" style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; text-align: left; font-size: 16px; line-height: 1.3; margin: 0 auto; Margin: 0 auto; padding-left: 0; padding-right: 0; width: 16.6667%; padding-bottom: 2px\"><table style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><th style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3\"> <table class=\"x_-1464192363spacer\" style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><td height=\"5px\" style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 5px; line-height: 5px\">&nbsp;</td></tr></tbody></table> <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://www.youtube.com/playlist?list=PLLbbcH8MnXJ5rQsQPyRt0n54ZJcsscyh9\" style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; color: rgb(33, 153, 232); text-decoration: none\"> <img src=\"/fg_weekly/tpl/youtube.jpg\" style=\"outline: none; text-decoration: none; width: auto; max-width: 100%; clear: both; display: block; border: none\" /> </a> </th></tr></tbody></table></th> </tr></tbody></table> </th>\n<th class=\"x_-1464192363expander\" style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3; visibility: hidden; width: 0; padding: 0\"></th>\n</tr></tbody></table></th> </tr></tbody></table> <table id=\"x_-1464192363unsubscribe\" class=\"x_-1464192363row\" style=\"border-spacing: 0; border-collapse: collapse; vertical-align: top; text-align: left; padding: 0; width: 100%; display: table\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"> <th class=\"x_-1464192363columns x_-1464192363small-12 x_-1464192363large-12 x_-1464192363last x_-1464192363first\" style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; text-align: left; font-size: 16px; line-height: 1.3; margin: 0 auto; Margin: 0 auto; padding-bottom: 16px; width: 564px; padding-left: 16px; padding-right: 16px\"><table style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; text-align: left; width: 100%\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><th style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3\"> <p style=\"color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; margin-bottom: 10px; Margin-bottom: 10px; font-size: 11px\">You received this email because you are subscribed to Weekly FortiGuard Update from Fortinet, Inc. This email was sent to soporte@browniespain.com. To unsubscribe please update the subscription settings in your <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://support.fortinet.com/\" style=\"font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; line-height: 1.3; color: rgb(33, 153, 232); text-decoration: none\">support</a> account</p> </th></tr></tbody></table></th> </tr></tbody></table> <table class=\"x_-1464192363container\" style=\"border-spacing: 0; border-collapse: collapse; padding: 0; vertical-align: top; background: rgb(254, 254, 254); width: 580px; margin: 0 auto; Margin: 0 auto; text-align: inherit\"><tbody><tr style=\"padding: 0; vertical-align: top; text-align: left\"><td style=\"border-collapse: collapse; vertical-align: top; color: rgb(10, 10, 10); font-family: Helvetica, Arial, sans-serif; font-weight: normal; padding: 0; margin: 0; Margin: 0; text-align: left; font-size: 16px; line-height: 1.3\"> </td></tr></tbody></table>\n</td></tr></tbody></table>\n</center> </td> </tr> </tbody></table> </div>",
  "display_key": {
    "value": "1388",
    "display_value": "1388"
  },
  "due_by_time": null,
  "is_reopened": false,
  "maintenance": null,
  "subcategory": {
    "id": "10918000000406278",
    "name": "Others"
  },
  "created_time": {
    "value": "1665806203215",
    "display_value": "Oct 15, 2022 05:56 AM"
  },
  "deleted_time": null,
  "is_escalated": false,
  "request_type": {
    "id": "10918000000010007",
    "name": "Incidencia"
  },
  "time_elapsed": "0",
  "assigned_time": {
    "value": "1665815020738",
    "display_value": "Oct 15, 2022 08:23 AM"
  },
  "resolved_time": null,
  "completed_time": null,
  "responded_time": null,
  "approval_status": null,
  "has_attachments": false,
  "unreplied_count": 0,
  "last_updated_time": {
    "value": "1665815028193",
    "display_value": "Oct 15, 2022 08:23 AM"
  },
  "linked_to_request": null,
  "is_service_request": false,
  "completed_by_denial": false,
  "email_ids_to_notify": [],
  "has_linked_requests": false,
  "notification_status": null,
  "cancel_flag_comments": null,
  "cancellation_requested": false,
  "is_first_response_overdue": false,
  "request_template_task_ids": [],
  "workflow_instance_details": null,
  "entity_instance_properties": [],
  "first_response_due_by_time": null,
  "request_template_checklist_ids": []
}