The ransomware group n0n has published firewall configuration files and password and key information linked to fintech firm Finzly, which connects banks to payment networks. The files describe connections to the Federal Reserve and rules for FedNow and FedACH traffic. The Fed said its payment services were unaffected, while Finzly said it rotated system keys and credentials and has found no evidence that bank customer data or system access information was compromised.
The incident involves Finzly's payment-network connectivity services for banks. It is not clear whether the leaked files could still be used to access systems. Even with credentials changed, however, the configurations may reveal network connections that banks and their vendors need to assess.
Leaked files show connections to Federal Reserve services
Finzly's BankOS platform connects banks to payment networks including ACH, Fedwire and FedNow. Customers use these services through a shared connection. The company's website listed 11 bank and credit union customers last week.
A Finzly spokesperson said the company had “rotated system keys and credentials,” adding that the configuration files alone do not provide access to Finzly systems or data. Its investigation has found no evidence that bank customer data or information used to access customer systems was compromised, and the company said customer operations were not affected. Finzly has notified law enforcement, engaged outside legal and forensic specialists, and begun contacting customers. It said it is working with regulators and customers.
A Federal Reserve spokesperson said Fed payment services were not affected. The files made public do not appear to contain customer data, bank data or transaction records. It has not been tested whether they include passwords or keys that remain valid. Comments in the configuration label it a “2023 config,” suggesting it may date from that year.
Last week, n0n threatened to publish network configurations and access keys for payment infrastructure, extending its deadline from Friday to Tuesday evening. After the deadline passed, the group released the files. Its actions suggest Finzly may not have paid a ransom, though n0n did not disclose how much it demanded. Threat intelligence firm Cyfirma has documented ransom demands by n0n against South Korean companies ranging from $600,000 to $14 million, payable in bitcoin.
How the device was accessed remains unclear
Finzly said an unauthorized third party accessed a device at its backup data center that held configuration information. The company has not said whether that device was the firewall in question, when the intrusion took place or how the attacker gained access.
Of the six files published by n0n, five appear to make up a configuration for a Fortinet FortiGate firewall. The sixth is a configuration summary that describes the device as a “payment gateway.” The files list a direct connection named “FED” and firewall rules for traffic labeled FedNow and FedACH. The summary also says passwords and keys in the configuration were decrypted on October 15.
Firewalls typically store passwords and keys in encrypted form. Fortinet acknowledged in 2019 that earlier versions of its firewall software used the same hard-coded key across devices to encrypt passwords in configuration files. Michael Tigges, principal tactical response analyst at cybersecurity firm Huntress, said it was “entirely possible” an attacker obtained keys by decrypting a configuration file. No public evidence has established how n0n did so.
Rotated credentials may not address all exposure
Changing passwords and keys can alter access credentials, but it does not automatically change the network connections described in a configuration. Rafe Pilling, senior director of threat research at cybersecurity firm Sophos, said an old firewall configuration can still show which connections are trusted. The released files outline paths between Finzly's cloud systems and the Federal Reserve, potentially giving an attacker insight into how those systems communicate.
Waseem Ahmed, engineering lead at security firm Secure.com, also said network layouts, IP addresses, tunnel endpoints and trust relationships tend to change more slowly than passwords. Even if old credentials no longer work, a leaked network map could reduce the time an attacker needs to understand a target.
Tigges said that, in a worst-case scenario, a leaked firewall configuration could be used to gain further control of a network or increase the risk of theft of account numbers and financial transactions, or of a ransomware attack. Available information does not establish whether n0n tried to use the keys to access systems, or whether Finzly detected unusual activity before the extortion attempt or learned of it only afterward. The company has also not said whether it changed the keys before or after the files were obtained or published.
Banks urged to verify credential changes and review logs
Denis Calderone, chief technology officer at cybersecurity firm Suzu Labs, advised banks affected by a vendor firewall configuration leak to ask the vendor to confirm that every credential and key in the files has been rotated and to provide evidence. Banks can also ask whether the vendor has notified the Federal Reserve.
Ahmed advised banks to map all connections to the vendor, replace credentials they control and coordinate new VPN keys with the vendor rather than waiting for the vendor to raise each issue. Calderone also recommended reviewing logs for unusual connections and extending the investigation to the months before the leak, not just the period after it became public.
The information available so far indicates that the published files did not contain bank customer data or transaction records and that Federal Reserve payment services were unaffected. The timing and method of access to the backup data center device, when the keys were rotated, and whether connections between banks and the vendor need further changes remain unresolved.