Fortinet has published an advisory on active exploitation of CVE-2022-42475 in the wild. My colleagues at Mandiant and myself followed up with analysis of a backdoor associated with this activity and targets Fortinet devices, dubbed BOLDMOVE.
Based on artefacts from a Windows variant of BOLDMOVE (54bbea35b095ddfe9740df97b693627b) that allude to a UTC+8 timezone and usage of the GBK character encoding in the actors environment, it is assessed with low confidence that the activity is affiliated to a China-nexus
threat actor.
https://www.mandiant.com/resources/blog/chinese-actors-exploit-fortios-flaw
Pwnallthethings
Dmitri Alperovitch
Łukasz 
