Loading story…
SentinelOne DFIR reported multiple intrusions in which threat actors compromised FortiGate Next-Generation Firewall (NGFW) appliances to gain an initial foothold, then extracted FortiGate configuration files containing service account credentials and network topology data. The activity targeted organizations including healthcare, government, and managed service providers, and in several cases was detected during the lateral-movement stage before full domain compromise. SentinelOne noted that many affected environments lacked sufficient FortiGate logging, limiting defenders’ ability to determine the exact initial access vector and timeline; observed dwell time from perimeter compromise to follow-on internal activity ranged from months to near-immediate escalation.
The intrusions were assessed as enabled by exploitation of recently disclosed Fortinet vulnerabilities and/or weak or misconfigured access controls on edge devices. Reported candidate vulnerabilities included CVE-2025-59718, CVE-2025-59719, and CVE-2026-24858, which could allow unauthorized access and facilitate configuration theft. In one investigated case, attackers created a new local administrator account named "support" on a compromised FortiGate and added permissive firewall policies to allow broad, unrestricted traversal across zones—behavior consistent with establishing durable access and potentially supporting initial access broker (IAB)-style operations that enable deeper Active Directory compromise via stolen directory-connected service accounts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Alongside the disclosure, SentinelOne recommended timely patching, stronger administrative controls, centralized SIEM log collection, and at least 14 days—preferably 60 to 90 days—of log retention. It also advised monitoring for FortiGate and Active Directory abuse because edge appliances often cannot run EDR tools.
SentinelOne assessed on March 10, 2026 that the two investigated incidents do not currently appear attributable to the same threat actor because their post-compromise tradecraft differed significantly. Both incidents were reported as detected and contained during lateral movement.
In its March 10, 2026 report, SentinelOne said the intrusions were likely enabled by exploitation of CVE-2025-59718, CVE-2025-59719, and CVE-2026-24858, or by opportunistic access using weak administrative credentials. Investigators noted limited FortiGate log retention prevented definitive root-cause determination in some cases.
On March 10, 2026, SentinelOne published findings on multiple early-2026 intrusions affecting healthcare, government, and managed service provider environments. The report said attackers abused vulnerable or weakly protected FortiGate appliances to obtain configuration data containing service account credentials and network topology information.
In February 2026, the actor from the first incident exfiltrated the FortiGate configuration file, decrypted embedded LDAP service account credentials, and used them to authenticate to Active Directory. The attacker then joined rogue workstations to the domain and conducted scanning and password spraying before being stopped.
In a separate incident in January 2026, attackers used FortiGate access to pivot quickly into the Windows domain, deployed Pulseway and MeshAgent, delivered a weaponized Java payload via DLL side-loading, and used PsExec to spread. They staged and likely exfiltrated NTDS.dit and the SYSTEM hive from domain controllers during the intrusion.
In one intrusion beginning in November 2025, an attacker gained access to a FortiGate device, created a new local administrator account, and modified firewall policies to remove access restrictions. SentinelOne later assessed this actor may have been functioning as an initial access broker.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcesentinelone.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Truesec reported that attackers exploited FortiGate FortiCloud SSO vulnerabilities **`CVE-2025-59718`** and **`CVE-2025-59719`** to gain unauthorized administrative access to vulnerable firewalls, provided FortiCloud SSO was enabled and the management interface was reachable. Using a valid FortiCloud account, the attackers generated a malicious SAML assertion accepted by the device, allowing them to take control of the firewall and extract its configuration. Investigations found the stolen configurations contained high-value secrets, including **SSL VPN credentials** and **Active Directory integration accounts**, which attackers used to modify VPN policies and NAT behavior, scan internal networks, exfiltrate data, and deploy ransomware through the **Domain Controller**. Truesec also described a technique in which attackers loaded a stolen configuration onto a controlled FortiGate device and downgraded FortiOS so stored passwords were re-encrypted with a weaker scheme, enabling rapid recovery of plaintext credentials and accelerating lateral movement toward full domain compromise.
Jun 29, 2026
Attackers have been actively targeting internet-exposed **Fortinet FortiGate** management interfaces to seize administrative control of firewalls, with reporting tying the activity to exploitation of **`CVE-2024-55591`** and a related authentication weakness, **`CVE-2025-24472`**. Fortinet said the primary flaw affects **FortiOS** and **FortiProxy** and stems from improper authentication in the Node.js websocket module, allowing an unauthenticated remote attacker to obtain **super-admin** access and full control of vulnerable devices. Observed intrusions included the creation of new administrator accounts, adding those accounts to **SSL VPN** groups, changing firewall policies, and using the compromised appliances to pivot into networks that were otherwise protected behind the VPN perimeter. Security guidance accompanying the disclosures urged organizations to apply Fortinet patches immediately, disable or restrict public exposure of management interfaces, harden FortiOS devices, and review logs for signs of compromise tied to the broader campaign against exposed firewall consoles.
Jul 24, 2026
A large-scale campaign dubbed **FortiBleed** exploited weak security on Fortinet FortiGate devices to steal credentials and gain access to government and corporate networks worldwide. Researchers said the operators scanned internet-exposed FortiGate portals, logged in with default or previously leaked credentials, and in many cases deployed a Go-based sniffer known as `FortigateSniffer` to intercept traffic and harvest additional logins. SOCRadar estimated that more than **430,000** FortiGate firewalls were targeted, over **110 million** credentials were collected, and about **12,000** devices were implanted, with activity observed across more than 150 countries. The stolen access was then used for deeper intrusions, including attacks tied to the **INC Ransom** and **Lynx** ransomware groups. Researchers reported that 354 compromises progressed into victim environments and at least 12 cases ended in ransomware deployment that encrypted hundreds of endpoints. In the UK, exposed accounts reportedly included Foreign Office staff, embassy personnel in Thailand and Mauritius, and local government officials, while organizations linked to the NHS, energy providers, and pharmaceutical suppliers were also affected; some stolen credentials were allegedly offered for sale on criminal forums by a user called **"SantaAd."** The UK National Cyber Security Centre said it was tracking ongoing brute-force activity against Fortinet devices and urged organizations to inspect networks, isolate compromised systems, and reset passwords.
Jul 10, 2026