Access to your VPN is for sale

CriticalLikelyNewPlatformfix by 22 Oct

New · Platform's

Nobody has it yet

It's Platform's, but no one has picked it up.

Where it came from, and where it is

One problem in one place, found by dark web.

1 source · 1 place

Dark web
Dark web monitoring
A Russian-language access forum, posted by a seller with 41 past sales
- A Russian-language access forum, posted by a seller with 41 past salesFortiGate SSL VPN, Nigerian payments company, $1,800Open

What closes it

Not yet: Every step in its dark web case is done, and nothing new turns up

Nobody can mark it fixed by hand. A person submits the fix; a scan or a retest decides it.

Why it ranks here

5th of 39 in your queue

Proof first, then exploitation in the wild, a public exploit, EPSS and severity, adjusted for exposure and how much the asset matters

Priority

82 / 100

Critical Where its severity starts it60
Straight onto the internet Its own address answers, with nothing in front+8
Criticality A Money moves or customer data lives here+8
Part of a chain Joined to other finds that add up to a break-in+6
Its priority82

The evidence

What each source saw

As each source gives it · secrets, keys and card numbers stay masked

The post · a russian-language access forum · Thu 15 Oct, 21:14

Open its dark web case

[SELL] FortiGate SSL VPN · Nigeria · fintech / payments
Revenue: $5–10M · Staff: 50–100
Access: domain user, VPN + RDP inside
Proof: screenshot of portal, 102.89.34.•••
Price: $1,800 · escrow ok · first to DM

Nigeria, paymentsTessellate Pay, payments, Lagos
FortiGate SSL VPNvpn.tessellatepay.com answers as FortiGate SSL VPN
Portal at 102.89.34.•••vpn.tessellatepay.com is 102.89.34.118
Staff 50–100Your profile says about 60 staff
Revenue $5–10MWe don't know yours

Why it matters here

Access brokers sell a way in; whoever buys it usually comes back with ransomware within days. The VPN they describe is the one discovery found on 12 Oct, which nobody has claimed yet and which runs a FortiOS attackers are exploiting now. The login itself most likely came from Tunde's laptop.

How sure we are

Four of the five details match you, and no other company we watch fits. Sellers blur details on purpose, so this is a match, not proof.

What to do

Take the SSL VPN offline, or upgrade FortiOS to 7.0.14 today
Reset every VPN account's password and require a second factor
Look for VPN logins from addresses you don't know, since 2 Oct
End any session it has open inside your network

Activity

What happened, and what was said

1 event · 0 comments · oldest first

SecureAssure found it on the dark webThu 15 Oct, 21:14

⌘ Enter to send

Joined to

One finding belongs with this one

The same story from another source: fix them together

CriticalFortiOS 7.0.12, affected by CVE-2024-21762Vulnerable softwareNew

[SELL] FortiGate SSL VPN · Nigeria · fintech / payments Revenue: $5–10M · Staff: 50–100 Access: domain user, VPN + RDP inside Proof: screenshot of portal, 102.89.34.••• Price: $1,800 · escrow ok · first to DM