ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploits, MCP Abuse, LiveChat Phish & More

Source: The Hacker News
Published: Thu, 19 Mar 2026 14:25:00 GMT

ThreatsDay Bulletin is back on The Hacker News, and this week feels off in a familiar way. Nothing loud, nothing breaking everything at once. Just a lot of small things that shouldn’t work anymore but still do.

Some of it looks simple, almost sloppy, until you see how well it lands. Other bits feel a little too practical, like they’re already closer to real-world use than anyone wants to admit. And the background noise is getting louder again, the kind people usually ignore.

A few stories are clever in a bad way. Others are just frustratingly avoidable. Overall, it feels like quiet pressure is building in places that matter.

Skim it or read it properly, but don’t skip this one.

Group-IB has shed light on the various tactics adopted by The Gentlemen, a nascent Ransomware-as-a-Service (RaaS) operation that consists of about 20 members. It originated from a payment dispute after its operator "hastalamuerte" opened a public arbitration thread on the RAMP cybercrime forum, accusing Qilin ransomware operators of unpaid affiliate commission amounting to $48,000. The group primarily uses CVE-2024-55591 , a critical authentication bypass vulnerability in FortiOS/FortiProxy, for initial access. "The group maintains an operational database of approximately 14,700 already exploited FortiGate devices globally," the company said . "Separate from exploited devices, the operators maintain 969 validated brute-forced FortiGate VPN credentials ready for attack." The Gentlemen also employs defense evasion via the bring your own vulnerable driver ( BYOVD ) technique to terminate security processes at the kernel level. About 94 organizations have already been attacked by this threat group since its emergence in July/August 2025.

Four security flaws (CVE-2025-71257, CVE-2025-71258, CVE-2025-71259, and CVE-2025-71260) have been disclosed in BMC FootPrints, a widely deployed ITSM solution, that could be chained into pre-authentication remote code execution. The attack sequence begins with an authentication bypass (CVE-2025-71257) that extracts a guest session token ("SEC_TOKEN") from the password reset endpoint, which is then used to reach an unsanitized Java deserialization sink (CVE-2025-71260) in the "/aspnetconfig" endpoint's "__VIEWSTATE" parameter. Exploitation via the AspectJWeaver gadget chain enables arbitrary file write to the Tomcat web root directory, achieving full remote code execution. Armed with the SEC_TOKEN, an attacker could also exploit two SSRF flaws (CVE-2025-71258 and CVE-2025-71259) and potentially leak internal data. The issues were addressed in September 2025.

The malware loader known as Hijack Loader is being used to deliver a previously undocumented, C++-based command-and-control (C2) framework known as SnappyClient. "SnappyClient has an extended list of capabilities, including taking screenshots, keylogging, a remote terminal, and data theft from browsers, extensions, and other applications," Zscaler ThreatLabz said . "SnappyClient employs multiple evasion techniques to hinder endpoint security detection, including an Antimalware Scan Interface (AMSI) bypass, as well as implementing Heaven’s Gate, direct system calls, and transacted hollowing. SnappyClient receives two configuration files from the C2 server, which contain a list of actions to perform when a specified condition is met, along with another that specifies applications to target for data theft." The framework was first discovered in December 2025. The attack chain involves the distribution of malicious payloads after a user visits a website impersonating the Spanish telecom firm Telefónica. It's assessed that the primary use for SnappyClient is cryptocurrency theft, with a possible connection between the developers of HijackLoader and SnappyClient based on observed code similarities.

Proofpoint has detailed a new technique called CursorJack that abuses Cursor's support for Model Context Protocol (MCP) deep links to enable local command execution or allow installation of a malicious remote MCP server. The attack takes advantage of the fact that MCP servers commonly specify a command in their "mcp.json" configuration. "The cursor:// protocol handler could be abused through social engineering in specific configurations," the company said . "A single click followed by user acceptance of an install prompt could result in arbitrary command execution. The technique could be leveraged both for local code execution via the command parameter or to install a malicious remote MCP server via the URL parameter." The enterprise security firm has also released a proof-of-concept (PoC) exploit on GitHub.

A new campaign is actively targeting known security flaws in Citrix NetScaler ( CVE-2025-5777 and CVE-2023-4966 ). According to Defused Cyber , more than 500 exploit attempts have been recorded against its honeypot system on March 16, 2026. "Highly elevated exploit activity against older vulnerabilities can often precede a zer

Source

Original report: https://thehackernews.com/2026/03/threatsday-bulletin-fortigate-raas.html