Chinese hackers exploit Fortinet VPN zero-day to steal credentials

Volexity reports that Chinese APT 'BrazenBamboo' is weaponizing a FortiClient Windows VPN zero-day via its DeepData toolkit to extract VPN usernames, passwords, and gateway details from JSON objects left in process memory; the flaw was reported in July 2024, remains unpatched, and enables credential theft, initial access, and lateral movement — IoCs and mitigation recommendations are provided.