Hackers Exploit Fortinet Flaw, Deploy ScreenConnect, Metasploit in New Campaign

Cybersecurity researchers observed an active campaign (tracked as Connect:fun) abusing CVE-2023-48788, a critical SQL injection in Fortinet FortiClient EMS (CVSS 9.3), to install ScreenConnect and Metasploit Powerfun via PowerShell, certutil, and msiexec; the activity targeted at least one exposed media company and shows manual, targeted exploitation with C2 communications and shared infrastructure seen by other vendors.