Navigating the Cyber Threat Landscape: Fortinet Exploits, Malware, and Authentication Risks

In the ever-evolving world of cybersecurity, staying informed about the latest threats is crucial for protecting your small business. This week brought a barrage of concerning news, including active exploitation of Fortinet vulnerabilities, the emergence of a new clipboard hijacking malware, potential weaknesses in NTLM authentication, and even attacks targeting AI coding assistants. Let's break down these threats and, more importantly, outline actionable steps you can take to safeguard your business.

The Week in Cybersecurity: A Rapid Rundown

According to a recent recap by The Hacker News, this week's landscape underscores a shift in attack strategies. Instead of brute-force speed, attackers are prioritizing stealth, persistence, and leveraging existing infrastructure. Automation is being turned against its creators, and vulnerabilities in seemingly reliable systems are being actively exploited. Here's a closer look at the key headlines:

• Fortinet FortiSIEM Exploits: A critical vulnerability (CVE-2025-64155) in Fortinet's FortiSIEM is being actively exploited, allowing attackers to execute unauthorized code or commands.
• VoidLink Linux Malware: A new cloud-native Linux malware framework called VoidLink is targeting cloud environments, offering attackers a wide range of tools for stealthy, long-term access.
• NTLM Relay Attacks: NTLM relay attacks are experiencing a resurgence, providing relatively easy avenues for compromising domain-joined hosts and enabling lateral movement and privilege escalation within networks.

Deep Dive: Understanding the Threats

Let's explore these threats in more detail, focusing on their potential impact on your small business and the technical aspects involved.

Understanding the Critical Fortinet FortiSIEM Flaw (CVE-2025-64155)

FortiSIEM is a Security Information and Event Management (SIEM) system designed to help organizations detect and respond to security threats. A vulnerability like CVE-2025-64155 allows attackers to bypass security measures and directly control the FortiSIEM appliance. This is particularly concerning because a compromised SIEM system can blind you to other attacks happening within your network.

Specifically, the vulnerability involves an unauthenticated argument injection vulnerability that leads to arbitrary file write, which then allows for remote code execution. The attacker can essentially inject their own commands and have them executed with administrator privileges. This is coupled with a file overwrite privilege escalation vulnerability which results in root level acces. The underlying vulnerability exists in the **phMonitor service,** a critical FortiSIEM component.

Impact for Small Businesses: If you use FortiSIEM (or any SIEM solution), this vulnerability can allow attackers to gain complete control of your security monitoring system, masking their activities and preventing you from detecting other intrusions. Attackers can change logs, disable monitoring and gain complete admin access to the appliance.

VoidLink Linux Malware: Targeting the Cloud

VoidLink is a sophisticated malware framework specifically designed for cloud environments. What makes it particularly dangerous is its modular design, allowing attackers to customize their attacks with a variety of loaders, implants, rootkits, and plugins. It effectively provides attackers with a persistent backdoor into your cloud infrastructure.

Impact for Small Businesses: If you rely on cloud services (AWS, Azure, Google Cloud, etc.), VoidLink can provide attackers with a foothold to steal data, disrupt services, and potentially compromise your entire cloud presence. This is a substantial risk for small businesses increasingly migrating their critical infrastructure to the cloud.

NTLM Relay Attacks: An Old Threat Making a Comeback

NTLM (New Technology LAN Manager) is an older authentication protocol still used in many Windows environments. An NTLM relay attack occurs when an attacker intercepts the authentication process between a client and a server and "relays" the authentication information to another server to gain unauthorized access. The attacker essentially tricks the second server into thinking they are the client.

The attack works because NTLM often lacks strong mutual authentication. The client proves its identity to the server, but the server *doesn't* strongly prove its identity to the client. This allows the attacker to sit in the middle and impersonate the client to another server.

Impact for Small Businesses: NTLM relay attacks can be used to compromise internal resources, escalate privileges, and move laterally within your network. If you haven't disabled legacy protocols in your company this can be a very damaging vulnerability.

Protecting Your Small Business: A Step-by-Step Checklist

Now that you understand the threats, let's discuss practical steps you can take to protect your business:

1. Patch Immediately: Prioritize patching vulnerable systems, especially Fortinet FortiSIEM. Check [Tenable.com](https://www.tenable.com/blog/cve-2025-64155-exploit-code-released-for-critical-fortinet-fortisiem-command-injection) and [Rapid7.com](https://www.rapid7.com/blog/post/etr-critical-vulnerabilities-in-fortinet-cve-2025-59718-cve-2025-59719-exploited-in-the-wild/) and Fortinet's advisory for the latest updates and instructions.
2. Review Cloud Security: Assess your cloud security posture and implement robust security measures, including multi-factor authentication, strong access controls, and regular security audits. Consider using a cloud security posture management (CSPM) tool.
3. Disable NTLM (Where Possible): If possible, disable NTLM authentication and migrate to Kerberos, which offers stronger security. If disabling NTLM is not feasible, implement mitigations such as Extended Protection for Authentication (EPA) and SMB signing. ([posts.specterops.io](https://posts.specterops.io/the-renaissance-of-ntlm-relay-attacks-everything-you-need-to-know-abfc3677c34e?gi=9d0e5a5b23f4) has more information)
4. Implement Multi-Factor Authentication (MFA): Enforce MFA for all critical accounts, including administrator accounts and cloud-based services.
5. Strengthen Access Controls: Implement the principle of least privilege, granting users only the access they need to perform their jobs.
6. Monitor Security Logs: Regularly review security logs for suspicious activity. Consider engaging a managed security service provider (MSSP) to provide 24/7 monitoring.
7. Train Employees: Educate employees about phishing attacks, social engineering, and other common threats. Use security awareness training platforms like Adaptive Security to protect your team with custom training and deepfake simulations.
8. Incident Response Plan: Develop and regularly test an incident response plan to ensure you can effectively respond to a security breach.
9. Vulnerability Scanning: Employ vulnerability scanning tools to proactively identify vulnerabilities in your systems before attackers do.

The Value of Professional IT Management

Staying ahead of the curve in cybersecurity is a complex and ongoing process. For small businesses, managing these threats effectively can be challenging with limited resources. Engaging a professional IT management service or an MSSP provides significant benefits:

• Expertise: Access to cybersecurity experts with in-depth knowledge of the latest threats and mitigation techniques.
• Proactive Monitoring: 24/7 monitoring of your systems to detect and respond to threats in real-time.
• Regular Security Assessments: Proactive identification and remediation of vulnerabilities.
• Cost-Effectiveness: Outsourcing cybersecurity can be more cost-effective than hiring and training in-house staff.
• Peace of Mind: Knowing that your systems are being protected by professionals allows you to focus on running your business.

In conclusion, the cybersecurity landscape is constantly evolving, and small businesses must remain vigilant to protect themselves from emerging threats. By understanding the latest risks and implementing the recommended security measures, you can significantly reduce your risk of becoming a victim of cybercrime. Consider partnering with a professional IT management service to ensure your business has the expertise and resources it needs to stay secure.