ShadowSilk Data Exfiltration Attack

FortiGuard Labs observed an active ShadowSilk APT campaign exploiting Drupal and WP-Automatic vulnerabilities (CVE-2018-7600, CVE-2018-7602, CVE-2024-27956) to gain initial access, deploy web shells and utilities, and install RATs for lateral movement and large-scale data exfiltration targeting government organizations across Central Asia and the Asia-Pacific; customers are advised to patch immediately and engage incident response as needed.