The Qilin ransomware operation has recently joined attacks exploiting two Fortinet vulnerabilities that allow bypassing authentication on vulnerable devices and executing malicious code remotely.

Qilin (also tracked as Phantom Mantis) surfaced in August 2022 as a Ransomware-as-a-Service (RaaS) operation under the “Agenda” name and has since claimed responsibility for over 310 victims on its dark web leak site.

Its victim list also includes high-profile organizations, such as automotive giant Yangfeng, publishing giant Lee Enterprises, Australia’s Court Services Victoria, and pathology services provider Synnovis. The Synnovis incident impacted several major NHS hospitals in London, which forced them to cancel hundreds of appointments and operations.

Threat intelligence company PRODAFT, which spotted these new and partially automated Qilin ransomware attacks targeting several Fortinet flaws, also revealed that the threat actors are currently focusing on organizations from Spanish-speaking countries, but they expect the campaign to expand worldwide.

“Phantom Mantis recently launched a coordinated intrusion campaign targeting multiple organizations between May and June 2025. We assess with moderate confidence that initial access are being achieved by exploiting several FortiGate vulnerabilities, including CVE-2024-21762, CVE-2024-55591, and others,” PRODAFT says in a private flash alert shared with BleepingComputer.

“Our observations indicate a particular interest in Spanish-speaking countries, as reflected in the data presented in the table below. However, despite this regional focus, we assess that the group continues to select its targets opportunistically, rather than following a strict geographical or sector-based targeting pattern.”

One of the flaws abused in this campaign, tracked as CVE-2024-55591, was also exploited as a zero-day by other threat groups to breach FortiGate firewalls as far back as November 2024. The Mora_001 ransomware operator has also used it to deploy the SuperBlack ransomware strain linked to the infamous LockBit cybercrime gang by Forescout researchers.

The second Fortinet vulnerability exploited in these Qilin ransomware attacks (CVE-2024-21762) was patched in February, with CISA adding it to its catalog of actively exploited security flaws and ordering federal agencies to secure their FortiOS and FortiProxy devices by February 16.

Almost a month later, the Shadowserver Foundation announced that it had found that nearly 150,000 devices were still vulnerable to CVE-2024-21762 attacks.

Fortinet security vulnerabilities are often exploited (frequently as zero days) in cyber espionage campaigns and for breaching corporate networks in ransomware attacks.

For instance, in February, Fortinet disclosed that the Chinese Volt Typhoon hacking group used two FortiOS SSL VPN flaws (CVE-2022-42475 and CVE-2023-27997) to deploy the Coathanger custom remote access trojan (RAT) malware, which had been previously used to backdoor a Dutch Ministry of Defence military network.

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is warning of Broadcom Brocade Fabric OS, Commvault web servers, and Qualitia Active! Mail clients vulnerabilities that are actively exploited in attacks.

The flaws were added yesterday to CISA’s ‘Known Exploited Vulnerabilities’ (KEV) catalog, with the Broadcom Brocade Fabric OS and Commvault flaws not previously tagged as exploited.

Broadcom Brocade Fabric OS is a specialized operating system that runs on the company’s Brocade Fibre Channel switches to manage and optimize storage area networks (SAN).

Earlier this month, Broadcom disclosed an arbitrary code execution flaw impacting Fabric OS versions 9.1.0 through 9.1.1d6, tracked under CVE-2025-1976.

While the flaw requires admin privileges to exploit, Broadcom says it has been actively exploited in attacks.

“This vulnerability can allow the user to execute any existing Fabric OS command or can also be used to modify the Fabric OS itself, including adding their own subroutines,” reads Broadcom’s bulletin.

“Even though achieving this exploit first requires valid access to a role with admin privileges, this vulnerability has been actively exploited in the field.”

CVE-2025-1976 was addressed with the release of Brocade Fabric OS 9.1.1d7. The latest branch, 9.2.0, is not impacted by this vulnerability.

The Commvault flaw, tracked under CVE-2025-3928, is an unspecified security problem that authenticated attackers can exploit remotely to plant webshells on target servers.

Commvault web servers are user-facing and API components of a backup system used by enterprises to protect and restore critical data.

Despite the requirements for authentication and exposure of the environment to the internet, the flaw is under active exploitation in the wild.

CVE-2025-3928 was fixed in versions 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms.

The third flaw CISA added to KEV is CVE-2025-42599, a stack-based buffer overflow problem impacting all versions of Active! up to and including ‘BuildInfo: 6.60.05008561’ on all OS platforms.

Active! mail is a web-based email client widely used by government, financial, and IT service organizations in Japan.

The flaw was flagged as actively exploited last week by Japan’s CERT, while SMB providers and ISPs in the country also announced service outages caused by related exploitation activity.

Qualitia addressed the problem with the release of Active! Mail 6 BuildInfo: 6.60.06008562.

CISA has given impacted organizations until May 17, 2025, to apply fixes or available mitigations for CVE-2025-3928 and May 19, 2025, for the other two flaws.

BaFin, Germany’s financial regulator, banned all public sales of Ethena GmbH’s USDe token this week, citing flaws in the approval process and violations of the European Union’s Markets in Crypto-Assets Regulation (MiCAR).

The regulator outlined several immediate actions against Ethena GmbH to enforce the ban.

According to BaFin, the synthetic dollar token had been offered as an unregistered security in Germany, prompting the authority to restrict its operations without delay.

BaFin Orders Asset Freeze and Website Shutdown for USDe Token

In its announcement, BaFin instructed Ethena GmbH to freeze the reserve assets backing the USDe token and halt all new customer registrations.

The company must also shut down its website, and a special representative has been appointed to oversee compliance with these directives.

“The BaFin also has reasonable grounds to suspect that Ethena GmbH in Germany sells securities in the form of sUSDe tokens from Ethena OpCo. Ltd. without the required prospectus,” the regulator said.

“The USDe and sUSDe tokens are interconnected in such a way that investors can receive a sUSDe token in exchange for a USDe token,” it added.

Despite the prohibition on primary sales and issuance, secondary market trading of USDe remains unaffected by the ban.

BaFin identified “serious deficiencies” in Ethena GmbH’s approval process, including noncompliance with MiCAR’s capital and asset reserve requirements.

Ethena GmbH had been operating under a transitional provision that allows issuers of asset-referenced tokens to continue business while awaiting regulatory approval.

The company applied for authorization on July 29, 2024, a day before the deadline, and has been issuing USDe in Germany since June 28, 2024.

Currently, approximately 5.4 billion USDe tokens are in circulation, with a substantial portion issued outside Germany before MiCAR took effect.

To safeguard customer interests, BaFin has ordered the company’s asset reserves to block and restrict the authority of its managing directors over those funds.

Holders of USDe tokens cannot redeem them directly with Ethena GmbH, though trading on secondary markets continues as normal.

BaFin’s statement also raised concerns about the company issuing sUSDe tokens, suggesting they could constitute unregistered securities.

The tokens are linked to USDe, allowing investors to exchange them while receiving additional returns.

The regulator is now considering further enforcement actions, which could include a complete ban on the public offering of these securities.

BaFin is overseeing the authorization process in collaboration with the European Central Bank (ECB), the European Banking Authority (EBA), and the European Securities and Markets Authority (ESMA).

Further details will be provided upon completion of the licensing process.

Ethena Defends USDe Token Amid BaFin Ban

Following BaFin’s ban on USDe in Germany, Ethena Labs reassured users that redemptions remain unaffected through its British Virgin Islands-based entity, Ethena BVI Limited.

The company, addressing the situation on X, stated that while its German subsidiary’s MiCAR application was denied, USDe remains fully backed.

“We are disappointed by this decision but will continue evaluating alternative regulatory frameworks,” Ethena wrote.

The firm also dismissed claims that its assets were frozen, clarifying that all funds remain accessible.

It plans to update its terms in the coming week to reflect the regulatory developments.

Ethena’s regulatory challenges come as institutional interest grows.

Recent investments include a $20 million backing from MEXC and a 500,000 ENA token purchase by World Liberty Financial.

BaFin Tightens Oversight on Synthetic Assets Across Europe

BaFin’s decision reflects the regulator’s cautious approach towards crypto assets operating within Germany’s jurisdiction.

Its ban on Ethena’s USDe token highlights the tightening regulatory grip on stablecoins and synthetic dollar tokens in Germany and across Europe.

With MiCAR enforcement ramping up, stablecoin and synthetic asset issuers will face increased scrutiny over compliance with capital, reserve, and disclosure requirements.

The outcome of BaFin’s assessment of Ethena GmbH could set a precedent for how synthetic dollar tokens are regulated under MiCAR across the EU.

Frequently Asked Questions (FAQs)

The post BaFin Bans Ethena’s USDe Token in Germany Over Approval Process Flaws appeared first on Cryptonews.

In a thread shared on X, Justin Bons—Founder and Chief Investment Officer of Cyber Capital, a fund he describes as Europe’s oldest cryptocurrency fund—set out a pointed critique of the Solana blockchain. He accuses Solana of suffering from numerous flaws, including repeated network outages, centralizing pressures through demanding hardware requirements, and what he views as a non-deterministic model that sacrifices reliability for speed.

Solana Has Flaws, But Is Still Leading

Bons conceded that Solana had shown improvements over time—especially in addressing outages—yet emphasized that blockchains “should never go down,” even in experimental stages. He drew attention to a trend of “significant congestion events” resulting from network scheduling bugs and issues with the QUIC protocol, while also stressing that sandwiching and MEV (Maximal Extractable Value) remain an “unsolved problem” industry-wide.

Bons described Solana’s hardware demands as particularly burdensome: “The biggest hardware cost by far is RAM, with 256GB of EC memory! This costs thousands of dollars…” Although the high cost of staking further compounds these barriers, Bons acknowledged that it continues to maintain more than 1,400 validators.

He criticized what he regards as a “broken local fee market” leading to degraded user experiences but expressed optimism that these issues would be resolved this year. Regarding Solana’s non-deterministic design, Bons argued it creates “less than a 1% chance of a TX failure,” but labeled it a structural inefficiency and waste. He also questioned the continued sponsorship of validators by the Solana Foundation, noting that while it was valuable during Solana’s initial growth, “the time has come when this should be discontinued… SOL can stand on its own now.”

Even so, Bons made it clear that he has moved from being a critic to a “supporter,” asserting, “SOL is a permissionless & sufficiently decentralized blockchain… BTC & ETH cannot provide this service at scale. That is why SOL is eating their lunch & while carrying on the cypherpunk torch.”

The remarks prompted a direct response from Solana community developer João Mendonça, who highlighted that the blockchain’s frequent pursuit of performance sometimes leads to near-breaking challenges. Mendonça stated, “Solana is pushing every single limit known to this industry… it still has a >99.9% uptime with more than a year record of no stoppage of block production.”

He believes additional occasional “accidents” remain possible until the network has multiple software clients—currently, the majority of stake runs on a single client—yet he maintained that Solana has continued to evolve. Mendonça also addressed the perceived centralization, stressing that high hardware requirements do not necessarily impede users’ ability to run nodes for verifiability.

According to him, node configurations can be stripped down to more modest requirements for those who only need to track the chain, reducing barriers to broader participation. He noted that all major blockchains employ incentives similar to Solana’s Foundation-funded sponsorship program in order to help bootstrap validator networks, observing that the Solana Foundation Delegation Program (SFDP) already declined from around 20% to about 12% of total stake.

Bons replied by underscoring that, while the presence of multiple clients might indeed reduce future network downtime, such outages should not be excused. He also reiterated skepticism about Solana’s non-deterministic approach, arguing it leads to an “optimistic model instead of a deterministic one,” which he believes reduces transaction reliability.

Mendonça pushed back by suggesting that Solana’s design “prioritizes speed to the user, pain to the developer… just how it should be,” and that halting the system prevents potential state corruption when significant issues arise, at least until multiple clients can secure network redundancy.

At press time, SOL traded at $192.

Featured image from Shutterstock, chart from TradingView.com