Fortinet "Ghost Logins": How Authentication Bypass Attacks Expose Gaps in Your Penetration Testing Strategy

Executive summary:
Critical authentication bypass vulnerabilities in Fortinet FortiGate and related products (CVE-2025-59718 and CVE-2025-59719) are now under active attack, allowing "ghost" SSO logins that completely sidestep normal controls and logs. For Australian organisations, this is more than a VPN or firewall problem – it is a board-level exposure that directly tests whether your external penetration testing, internal penetration testing, and red team assessment services are capable of simulating SSO abuse, identity takeovers, and lateral movement across hybrid networks.

What just happened: Fortinet SSO auth-bypass under active attack

Fortinet has disclosed critical authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719) affecting FortiOS, FortiProxy and FortiSwitchManager, impacting FortiCloud SSO flows into FortiGate and related appliances. These flaws allow attackers to forge or replay SSO artefacts and gain administrative access to appliances without valid credentials, effectively walking straight past login prompts and MFA.

Threat intelligence providers report malicious SSO logins and active exploitation "in the wild", with attackers using the bypass to obtain root-level control of VPN gateways and security appliances. Once an attacker owns the FortiGate, your perimeter, VPN trust boundary and network segmentation controls can be silently rewritten from the inside, turning your firewall into the attacker's beachhead.

Key takeaways for boards and CISOs:

• This is not a theoretical CVE; exploitation has already started.
• Compromise of the FortiGate tier effectively neutralises network security controls.
• Traditional penetration testing methods that only "scan and report" will miss SSO-centric and identity-abuse paths.

Why this incident reframes "what is penetration testing" for modern enterprises

At board level, "what is penetration testing" is changing from a narrow view of port scanning and basic exploitation to a broader application security assessment across identity, SSO, and cloud edge devices. Attacks on Fortinet SSO show how real adversaries chain weaknesses across VPNs, SAML/OIDC flows, RBAC misconfigurations and internal lateral movement to achieve business impact.

Modern penetration testing services in Australia must therefore validate not just internet-facing ports, but also:

• The integrity of SSO and identity federation to VPNs, admin portals and cloud consoles.
• Whether a compromised VPN appliance or identity token can be used to bypass network segmentation and reach crown-jewel systems.

For Australian organisations subject to PCI DSS, GDPR, or the Cyber Security Act 2024, boards need assurance that penetration testing is aligned to real-world attack paths – especially those starting at identity and VPN infrastructure.

How Fortinet SSO attacks actually work (and why scanners alone won't save you)

Authentication bypass through SSO flows

The Fortinet flaws centre on improper verification of SSO tokens and cryptographic assertions in FortiCloud SSO, enabling authentication bypass on FortiOS, FortiProxy and related components. In practice this means an attacker can submit crafted or replayed SAML/OIDC-style artefacts or exploit validation gaps to appear as a legitimate SSO user – often with administrator-level rights.

Once logged in as a "ghost" admin, attackers can:

• Change VPN and firewall policies to open backdoors and exfiltration paths.
• Create new trusted SSO configurations or local admin accounts that persist beyond patching.
• Disable logging, alter log destinations, or route logs to attacker-controlled collectors.

From VPN edge to complete network takeover

Observed exploitation patterns show a two-stage progression: first, auth bypass to gain control of the management plane; second, pivoting from the appliance into internal networks and management tools. With root-level control of a VPN gateway, an attacker can impersonate users, inject routes, and access internal services as if they were a trusted remote employee.

This adversary behaviour is beyond what a basic vulnerability assessment or simple penetration testing tool list will detect, because:

• Scanners tend to focus on version detection and known signatures, not subtle SSO state logic.
• Many organisations treat VPNs and firewalls as "out of scope" for application security assessment, leaving a blind spot between network penetration testing and web application penetration testing.

Vulnerability assessment vs pen test: why boards must care

Many organisations still use "vulnerability assessment vs pen test" interchangeably, but Fortinet SSO exploitation demonstrates why the distinction matters at the governance level.

Aspect	Vulnerability Assessment	Penetration Testing
Approach	Automated scanning for known CVEs and misconfigurations.	Manual exploitation of authentication flows, SSO logic, and chained weaknesses.
Output	Point-in-time lists of issues, ranked by CVSS but often without business context.	Evidence-based scenarios demonstrating how an attacker could turn a Fortinet auth bypass into data theft, ransomware spread, or regulatory breach.
Board Value	Inventory of risks.	Proof of realistic breach paths and mitigation priorities.

For CISOs, vulnerability assessment vs pen test is no longer a technical nuance; it is a question of whether the organisation has realistic evidence on how its identity and VPN stack would withstand a modern attack.

Mapping Fortinet SSO risk to penetration testing methods

To address this class of exposure, organisations should revisit penetration testing methodology and ensure it explicitly covers identity and SSO-driven threats.

External penetration testing

A modern external penetration testing engagement should now:

• Enumerate VPN, SSO, and edge appliances (FortiGate, Citrix, Palo Alto, ZTNA, CASB) as first-class targets.
• Attempt controlled abuse of SAML/OIDC, FortiCloud SSO and other federation mechanisms, not just open ports.

Internal penetration testing

Internal penetration testing then assumes the Fortinet layer has been compromised and asks, "What happens next?"

• Can a fake "VPN user" pivot from remote access networks to core AD, ERP and OT segments?
• Are EDR, NAC and micro-segmentation controls effective once an attacker is "inside the wire" with legitimate-looking network paths?

Web and API penetration testing

Because FortiGate typically fronts critical web applications and APIs, web application penetration testing and API penetration testing should be integrated into the same scenario.

• Test whether compromised VPN or reverse-proxy tiers weaken rate-limiting, WAF rules, or API authentication.
• Validate that tokens and sessions issued behind the VPN comply with least privilege and cannot be abused to escalate across tenants or environments.

Red team assessment services: simulating SSO and VPN abuse

Where penetration testing stops at enumeration and exploitation of specific hosts, red team assessment services simulate a persistent adversary who will chain multiple weaknesses to reach strategic objectives.

A mature red team scenario for Fortinet SSO risk should include:

• Phishing or credential theft to obtain low-privilege SSO accounts, followed by attempts to exploit auth-bypass flaws.
• Use of compromised FortiGate to reconfigure VPN split-tunnelling, routing, and DNS to quietly access backup networks, directory services and cloud control planes.
• Emulation of data staging, exfiltration and ransomware deployment pathways that start from the VPN tier rather than a traditional desktop compromise.

Regulatory and compliance implications for Australian organisations

Australia's Cyber Security Act 2024 and the new mandatory ransomware and cyber extortion payment reporting obligations mean that poorly secured VPN and SSO infrastructure now has regulatory as well as technical consequences.

• From 30 May 2025, Australian businesses above a $3 million turnover must report ransomware and cyber-extortion payments to ASD within 72 hours, regardless of payment size.
• Failure to report can attract civil penalties, and regulatory scrutiny is increasingly focused on whether "reasonable steps" were taken to protect networks and data before the incident.

For PCI DSS penetration testing and GDPR penetration testing obligations, a compromised VPN or firewall that exposes cardholder or personal data would be viewed as a preventable control failure if critical auth-bypass patches were missed or if testing scope excluded SSO and VPN infrastructure.

Board-level implications:

• Penetration testing for cloud security and VPN/SSO must be explicitly in scope for compliance attestations.
• Penetration testing price in Australia should be evaluated against the potential cost of a reportable ransomware event and associated regulatory penalties.

Building a modern penetration testing roadmap around identity and VPN risk

CISOs and IT Directors should use the Fortinet incident as a forcing function to modernise their penetration testing roadmap.

Prioritise identity-aware testing

• Integrate web application penetration testing, API penetration testing, and SSO abuse scenarios into core testing programmes, not as add-ons.
• Ensure penetration testing methods include manual review of SSO logic, JWT/SAML validation, RBAC enforcement and session management beyond automated scanning.

Cover the full technology stack

Your roadmap should explicitly call out:

• Network penetration testing that includes VPNs, firewalls, and SD-WAN controllers as high-value assets, not "plumbing".
• Internal penetration testing focused on lateral movement from VPN and privileged network zones into Active Directory, databases, and cloud management environments.
• Cloud penetration testing for IaaS, PaaS and SaaS, ensuring misconfigured SSO and conditional access policies are identified early.
• Mobile application penetration testing and IoT penetration testing for scenarios where remote staff, field devices or OT gateways rely on FortiGate or similar VPN infrastructure.

Make it accessible for small and mid-market businesses

Fortinet is widely deployed in small and mid-market Australian organisations, not just large enterprises. Penetration testing for small business therefore needs:

• Right-sized packages that still include VPN/SSO testing, not just a basic external scan.
• Clear penetration testing quote options that show what is covered (and what is not) so boards can make informed risk decisions.

Visualising the attack path: from FortiGate to data loss

Below is a simple conceptual diagram that helps boards understand the Fortinet SSO attack chain:

• Stage 1: Attacker discovers exposed FortiGate VPN portal and targets SSO integration.

• Stage 2: Auth‑bypass exploit yields administrative access to FortiGate management.

• Stage 3: Attacker modifies VPN policies, creates backdoor accounts, and routes traffic into internal networks.

• Stage 4: Lateral movement into AD, databases, SaaS and cloud consoles; staging for ransomware or data theft.

How to engage: penetration testing services Australia should be demanding

In light of these Fortinet SSO vulnerabilities and the broader ransomware reporting landscape in Australia, organisations should look to hire a penetration tester or penetration testing company Australia that can demonstrate:

• Proven experience testing VPNs, SSO, and identity-centric attack paths – not just generic web testing.
• A clear penetration testing methodology that covers external penetration testing, internal penetration testing, cloud penetration testing, and application security assessment in a single, cohesive programme.
• Transparent guidance on penetration testing services Australia-wide, including realistic penetration testing price Australia figures and options to book a pen test aligned to your financial year and regulatory deadlines.

For boards, the question is no longer "penetration testing vs vulnerability assessment", but "are we testing the systems attackers are actually targeting – our VPNs, SSO, and cloud edge – with realistic adversary techniques?"

Call to action:
If your organisation relies on Fortinet or similar VPN and SSO infrastructure, now is the right time to schedule an integrated external, internal and application penetration testing engagement focused on identity and VPN abuse scenarios. Engage a specialist penetration testing company in Australia that can provide a tailored penetration testing roadmap, a clear penetration testing quote, and red team assessment services to validate your readiness against the next wave of SSO-driven attacks.

Weekly Threat Briefing: Australia (14-21 December 2025)

Executive Summary

As we approach the end of 2025, the Australian cyber threat landscape has experienced a volatile week, with significant incidents rocking the education and healthcare sectors. The last seven days have been defined by the active exploitation of critical vulnerabilities in modern web frameworks and a series of ransomware attacks targeting sensitive patient and staff data.

This week’s briefing highlights a major data breach at the University of Sydney, a ransomware attack on fertility provider Genea, and the "React2Shell" vulnerability that is currently reshaping cloud security priorities.

Sector Spotlight

Education: University of Sydney Code Library Breach On 17 December 2025, the University of Sydney notified its community of a significant cyber security incident involving unauthorised access to an online IT code library. While the environment was primarily used for development and code storage, it inadvertently hosted historical data files containing the personal information of approximately 27,000 individuals.

• Impact: The breach affects roughly 10,000 current staff, 12,500 former staff, and 5,000 alumni and students. Exposed data includes names, dates of birth, phone numbers, and addresses.
• Analysis: This incident underscores a critical "DevSecOps" oversight: the use of production (or production-like) data in non-production environments. Attackers are increasingly targeting these "softer" development pipelines to pivot into core systems or exfiltrate overlooked data.

Healthcare: Ransomware Surge and Security Audits The healthcare sector remains the primary target for extortionists this week.

• Genea Ransomware Attack: On 20 December, reports confirmed that Genea, one of Australia’s leading fertility service providers, fell victim to a cyber attack. The Termite ransomware gang has claimed responsibility, alleging the theft of 700GB of sensitive patient data, including medical histories and diagnostic results.
• Harbour Town Doctors: Earlier in the week, the Rhysida ransomware group listed the Queensland-based Harbour Town Doctors on its leak site, threatening to release patient data if ransom demands were not met.
• Systemic Risks: A concerning NSW Health audit released on 19 December revealed a "normalisation of non-compliance" among clinicians. Driven by time pressures, staff were found routinely sharing passwords and using personal devices for patient data, creating a massive, unmanaged attack surface.

SaaS & Cloud: The "React2Shell" Crisis SaaS providers and organisations running modern web applications are currently racing to patch CVE-2025-55182, dubbed "React2Shell".

• The Vulnerability: A critical (CVSS 10.0) unauthenticated Remote Code Execution (RCE) flaw in React Server Components, affecting React 19 and Next.js frameworks.
• Active Exploitation: Intelligence indicates that China-nexus threat groups, including Earth Lamia and Jackpot Panda, are actively exploiting this flaw to deploy cryptocurrency miners (XMRig) and persistent backdoors into cloud environments.
• Why it Matters: This is a supply-chain style risk for any Australian business relying on modern JavaScript frameworks for their customer-facing digital platforms.

Critical Infrastructure & Government The Australian Cyber Security Centre (ACSC) and global partners have issued alerts regarding Fortinet vulnerabilities.

• FortiCloud SSO Bypass (CVE-2025-59718): A critical flaw allowing attackers to bypass authentication on cloud-managed security appliances. With the holiday season approaching, unpatched edge devices are a prime target for initial access brokers.

Key Vulnerabilities Exploited (Week of 14-21 Dec)

• React Server Components (CVE-2025-55182): Critical RCE allowing full server takeover via a single HTTP request.
• Fortinet FortiCloud (CVE-2025-59718): Authentication bypass in Single Sign-On mechanisms.
• Windows Cloud Files Mini Filter (CVE-2025-62221): A privilege escalation flaw patched this week, which attackers are chaining with RCE bugs to gain SYSTEM privileges.

Conclusion

The events of this week demonstrate that "non-production" does not mean "non-critical." The University of Sydney breach highlights the dangers of data sprawl in development environments, while the Genea and React2Shell incidents remind us that both our physical health data and our digital infrastructure are under constant siege. Australian organisations must urgently audit their development pipelines and patch React-based applications immediately.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Australia - 20 December 2025

Executive Summary

The Australian cyber threat landscape has seen significant volatility in the last 24 hours. The primary focus for security teams today is the catastrophic "React2Shell" vulnerability (CVE-2025-55182), which is actively being exploited to deploy cryptocurrency miners and backdoors across Australian cloud environments. Simultaneously, the healthcare and education sectors are under heavy fire, with a major breach disclosed by the University of Sydney and a confirmed ransomware attack on fertility provider Genea.

Here is your daily deep dive into the threats impacting Australian organisations.

Critical Vulnerability Alert: "React2Shell" (CVE-2025-55182)

• Severity: Critical (CVSS 10.0)
• Affected Systems: React Server Components (versions 19.x), Next.js, and downstream web frameworks.
• The Threat: A maximum-severity remote code execution (RCE) flaw allows unauthenticated attackers to execute arbitrary code via malicious HTTP requests.
• Status: Active Exploitation. Threat actors are currently scanning for vulnerable Australian SaaS and eCommerce platforms. We have observed the deployment of XMRig miners and the 'COMPOOD' backdoor. With 39% of global cloud environments estimated to be vulnerable, this is a "patch now" event.
• Action: Immediate patching of React and Next.js instances is mandatory. WAF rules should be tuned to block suspicious serialised payloads.

Sector Highlights

Healthcare: Ransomware & Insider Negligence

• Genea Breach: One of Australia’s largest fertility service providers, Genea, has confirmed a cyber attack. The Termite ransomware gang has claimed responsibility, allegedly stealing 700GB of sensitive patient data, including medical histories and diagnostic results. This group is known for using a modified version of the Babuk ransomware.
• NSW Health Audit: A concerning audit released yesterday revealed that clinicians in NSW are routinely bypassing cyber security controls to save time. The report highlighted a "normalisation of non-compliance," with staff sharing passwords and using personal devices for patient data—a significant vector for potential credential harvesting attacks.

Education / EdTech: Code Repository Compromise

• University of Sydney: Yesterday (19 December), the University of Sydney disclosed a data breach affecting over 20,000 staff and affiliates. Hackers accessed an internal code library used by IT teams. While the breach was contained to a single platform, it exposed historical personal data. This incident highlights the growing trend of targeting non-production environments (DevOps pipelines) to pivot into core systems.

Government & Defence: Supply Chain Woes

• Supply Chain Risks: Following the recent updates on the IKAD Engineering breach, the Australian Signals Directorate (ASD) continues to warn of "KillSec" and other groups targeting the defence supply chain.
• Fortinet Alert: The ACSC has issued a critical alert regarding CVE-2025-59718 and CVE-2025-59719. These vulnerabilities allow authentication bypass in FortiCloud SSO. Government agencies and contractors utilising Fortinet edge devices must review their networks for unauthorised access immediately.

FinTech & SaaS

• API Security: With the React2Shell vulnerability, FinTech platforms utilising modern JavaScript frameworks are at heightened risk. We are seeing increased scanning activity targeting API endpoints that utilise server-side rendering.
• Vroom by YouX: The sector remains on high alert following the Vroom incident, with regulators pushing for stricter third-party risk management as "fintechs are being breached" through their vendors.

Technical Focus: Web & Cloud

• Windows Zero-Day: Microsoft’s December patch Tuesday addressed CVE-2025-62221, a privilege escalation flaw in the Windows Cloud Files Mini Filter Driver. Attackers are chaining this with RCE bugs to gain SYSTEM privileges.
• Chrome WebGPU: Google has patched CVE-2025-14765, a use-after-free vulnerability in the WebGPU API. Staff browsing the web can trigger this exploit simply by visiting a malicious page, making browser updates critical for corporate fleets.

Threat Actor Profile: Termite

• Origin: Likely financially motivated; tools suggest overlap with Babuk source code.
• Tactics: Double extortion (encryption + data leak). They target sectors with high uptime pressure (Healthcare, Utilities).
• Current Status: Actively leaking data from Australian healthcare victims on the dark web.

Contact us for a quote for penetration testing service or adversary simulation.

Australian Cyber Threat Briefing: Healthcare Security Gaps & Critical SaaS Vulnerabilities

Executive Summary The last 24 hours have exposed significant fragility in Australia’s Healthcare and Education sectors, with a major audit revealing systemic security bypasses in NSW Health and a fresh data breach hitting the University of Sydney. Globally, critical vulnerabilities in Fortinet’s cloud infrastructure and React server components are demanding immediate patching cycles. This briefing summarises the key threats, incidents, and vulnerabilities impacting Australian organisations today.

Sector Spotlight: Healthcare & SaaS

NSW Health Audit Reveals "Normalised" Security Bypasses A concerning audit released today (19 December) has highlighted a culture of non-compliance within NSW Health districts. Driven by "clinical urgency," clinicians are routinely bypassing cybersecurity controls—saving sensitive patient data to personal devices and leaving shared terminals logged in. With the healthcare sector already the highest reporter of data breaches in Australia, this "shadow IT" behaviour significantly widens the attack surface for ransomware groups and data extortionists.

SaaS Supply Chain: Phreesia & ConnectOnCall Incident The risks of third-party SaaS integrations were underscored by the disclosure of a breach affecting Phreesia (via its subsidiary ConnectOnCall), impacting over 910,000 individuals. The compromise of this SaaS platform exposes sensitive health and personal data, reminding Australian healthcare providers to rigorously audit their digital supply chains.

Education & EdTech: Targeted Attacks

University of Sydney Code Repository Breach The University of Sydney confirmed yesterday (18 December) that threat actors breached an online IT code library. While the system was primarily for development, it contained historical files hosting the personal information of approximately 27,000 staff, students, and alumni. This incident mirrors the growing trend of attackers targeting non-production environments (DevOps infrastructure) to pivot into core systems or exfiltrate overlooked data.

Ransomware Targeting Schools The Fog ransomware gang has claimed an attack on Waverley Christian College, allegedly stealing 5GB of data. This follows a broader campaign against the education sector, including a recent hit on the "Thanks for the Help" (TFTH) support platform, emphasising that schools remain high-value targets for extortion due to the sensitivity of student data.

Critical Vulnerabilities: Web, Cloud & APIs

Fortinet FortiCloud SSO Bypass (Critical) The Australian Cyber Security Centre (ACSC) has flagged critical vulnerabilities in Fortinet products, specifically CVE-2025-59718 and CVE-2025-59719. These flaws allow for FortiCloud SSO Login Authentication Bypass, potentially granting attackers unauthorised administrative access to cloud-managed security appliances. Immediate patching is mandatory.

React Server Components (CVE-2025-55182) A critical vulnerability has been discovered in React Server Components, a framework widely used in modern web applications and SaaS platforms. Exploitation can lead to remote code execution (RCE). Australian developers and AppSec teams using React for front-end architecture must review their implementations immediately.

Government & Critical Infrastructure

Pro-Russia Hacktivist Activity A joint advisory released this week warns of renewed opportunistic attacks by pro-Russia hacktivist groups targeting Australian critical infrastructure. These groups are utilising DDoS vectors and basic exploit scripts to disrupt operations in the energy and transport sectors.

AI Systems in Government Reports from iTnews today indicate the Department of Home Affairs is preparing to deploy AI on sensitive government data. This move comes as OpenAI warns that new models present "high" cyber risks. The convergence of AI integration in government systems raises concerns about "prompt injection" attacks and data leakage, necessitating strict guardrails.

FinTech & Financial Services

Antidot Banker Malware Campaign Australian banks are currently being targeted by the Antidot Banker malware. The campaign utilises fake recruitment lures to trick victims into downloading malicious Android CRM applications. Once installed, the malware harvests banking credentials and intercepts 2FA codes. FinTech apps should enforce rigorous device integrity checks to detect such compromises.

IoT & Devices

SonicWall SSL VPN Exploitation Active exploitation of SonicWall SSL VPNs (linked to CVE-2024-40766) continues to be observed in the wild. Despite being an older CVE, unpatched legacy devices in Australian networks are serving as initial access vectors for ransomware groups like Akira.

---

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: React2Shell Exploits Surge & Uni Sydney Breach

Executive Summary

As we approach the holiday shutdown period, the Australian cyber threat landscape has intensified significantly over the last 24 hours. The standout threat is the rapid weaponisation of the React2Shell (CVE-2025-55182) vulnerability, which is currently being exploited in the wild by state-sponsored actors and botnets alike. Additionally, the University of Sydney has confirmed a data breach impacting historical records, reminding the Education sector that non-production environments remain a critical risk vector.

Here is your daily deep dive into the threats shaping the Australian cyber security environment today.

---

Top Priority: Critical Web Application Vulnerabilities

1. The "React2Shell" Crisis (CVE-2025-55182)

Sectors Impacted: SaaS, FinTech, eCommerce, Government The most critical threat facing Australian organisations today is CVE-2025-55182, dubbed "React2Shell". This critical Remote Code Execution (RCE) vulnerability affects React Server Components (RSC) via unsafe server-side deserialisation.

• Status: Active Exploitation. Telemetry indicates over 127 million exploit attempts globally in the last week, with Australian infrastructure heavily targeted in the last 24 hours.
• Attack Vector: Threat actors are sending crafted payloads to vulnerable endpoints to execute arbitrary code without authentication.
• Observed Campaigns:
  • "ReactOnMyNuts": A new botnet campaign deploying XMRig cryptominers and Mirai variants.
  • State-Sponsored Activity: Intelligence suggests Chinese-affiliated groups are leveraging this flaw for initial access into critical networks.
• Action Required: Immediate patching is mandatory. Web Application Firewalls (WAF) should be tuned to block suspicious serialised objects in HTTP bodies.

2. Fortinet FortiCloud SSO Bypass (CVE-2025-59718 & CVE-2025-59719)

Sectors Impacted: Healthcare, Government, IoT The ASD’s ACSC has flagged critical vulnerabilities in Fortinet products allowing FortiCloud SSO Login Authentication Bypass.

• Risk: Attackers can bypass authentication to gain administrative access to managed network devices.
• Impact: This is particularly dangerous for distributed networks in Healthcare and Retail relying on SD-WAN and cloud management.

---

Sector-Specific Intelligence

🎓 Education / EdTech

University of Sydney Data Breach Yesterday (17 December 2025), the University of Sydney notified staff and students of a cyber incident involving unauthorised access to an online IT code library.

• The Breach: While the environment was primarily for development, it contained "historical data files" with personal information.
• Analysis: This highlights a classic "Shadow IT" and DevOps failure—production data bleeding into testing environments. EdTech providers must rigorously enforce data sanitisation in non-production pipelines.

💳 FinTech & SaaS

ThinkMarkets Alleged Breach Reports have emerged of an alleged data breach targeting online trading broker ThinkMarkets.

• Threat Actor: The data has reportedly been published by the RansomHub group.
• Trend: FinTech remains a primary target for extortion-based attacks due to the high sensitivity of client financial data.

🏥 Healthcare

Ransomware Persistence Healthcare providers are urged to maintain high vigilance as we enter the holiday season—a statistically high-risk period for ransomware attacks.

• Specific Threat: The MediSecure incident fallout continues to influence policy, but new campaigns targeting IoMT (Internet of Medical Things) devices via the Fortinet vulnerabilities mentioned above are a pressing concern.

🤖 AI Systems

New Risk Vectors

• OpenAI Warning: New models released this month have been flagged as presenting "high" cyber risks regarding their ability to aid in sophisticated phishing and exploit generation.
• Defence: CrowdStrike has launched Falcon AIDR to secure AI prompts, reflecting the growing necessity to secure the inputs and outputs of Large Language Models (LLMs) used in enterprise environments.

---

Seasonal Scam Alert: "Australia Post" Smishing

With Christmas delivery deadlines looming, a massive wave of SMS phishing (smishing) campaigns impersonating Australia Post has been detected. These messages utilise fake "delivery failure" notifications to steal credit card details. Organisations should remind staff not to use corporate devices for personal shopping verifications to reduce the attack surface.

Recommendations for the Next 24 Hours

1. Audit for React (CVE-2025-55182): Identify all public-facing applications using React Server Components and apply patches or WAF mitigations immediately.
2. DevOps Hygiene: Review all code repositories (GitHub, GitLab, internal) for hardcoded credentials or unmasked production data, following the lesson from the University of Sydney incident.
3. Fortinet Patching: Ensure all FortiCloud-managed devices are updated to the latest firmware to prevent SSO bypass.

Contact us for a quote for penetration testing service or adversary simulation.