BOLDMOVE

Executive Summary

BOLDMOVE leverages a critical FortiOS SSL‑VPN vulnerability (CVE‑2022‑42475) to gain remote access to both Linux servers and specialized FortiGate firewall devices. After compromise it installs a persistent backdoor that can exfiltrate credentials, modify network policies, and pivot to internal hosts. This activity poses an acute risk to organizations using Fortinet infrastructure.

BOLDMOVE is a multi‑platform backdoor written largely in C and associated with state‑sponsored operations from the People’s Republic of China during 2022–2023. It ships as both Windows and Linux binaries, and several Linux versions are specially engineered to target FortiGate firewall platforms running FortiOS. Researchers trace BOLDMOVE's activity to a zero‑day exploitation of CVE‑2022‑42475, a critical flaw in FortiOS SSL‑VPN that allowed remote code execution on vulnerable devices. Once an attacker compromises a FortiGate appliance via the SSL‑VPN component, BOLDMOVE establishes persistent footholds by installing resident binaries and opening backdoor sockets listening for C&C traffic. The malware can exfiltrate credentials from local stores, manipulate firewall rules to open network entry points, and pivot into connected hosts over the internal network. In Linux hosts it offers a reverse shell interface, while on Windows systems it leverages native shell capabilities to issue commands. The limited public evidence indicates that BOLDMOVE primarily operates via exploitation of publicly exposed SSL‑VPN ports, followed by stealthy lateral movement and data collection. Because the backdoor is tailored for FortiGate devices, security teams protecting network perimeter appliances should be wary of unknown outbound connections originating from firmware processes post‑update or patching cycles.

Key Capabilities

• Exploits the CVE‑2022‑42475 flaw in FortiOS SSL‑VPN for remote code execution
• Installs a persistent backdoor on Linux, Windows, and FortiGate devices
• Provides reverse shell access allowing command execution
• Harvests local credentials and can modify firewall rules to create open channels
• Facilitates lateral movement within internal networks

ATT&CK Techniques

Recommended Actions

• Apply the latest firmware update that resolves CVE‑2022‑42475 to all FortiOS assets immediately.
• Configure network IDS/IPS signatures for abnormal outbound traffic from Fortinet processes on ports 443 and 8443.
• Patch all Linux servers against known vulnerabilities and remove any suspicious reverse shell binaries.
• Conduct host integrity checks targeting the /opt/fortigate and related directories for unexpected executables.
• Deploy endpoint detection solutions with heuristics for unknown C&C domain lookups and persistent service creation.

Suggested Tags