Loading story…
FBI and CISA warned that APT actors were actively scanning internet-facing Fortinet devices and exploiting multiple FortiOS vulnerabilities, including CVE-2018-13379, CVE-2020-12812, and CVE-2019-5591, to gain initial access and maintain a foothold for follow-on attacks. The agencies said the activity affected government, commercial, technology, and critical infrastructure organizations, with scanning observed on ports 4443, 8443, and 10443. In one cited case, an APT group almost certainly exploited a FortiGate appliance to access a web server hosting a U.S. municipal government domain and likely created the username elie on the network.
The campaign built on long-running exploitation of Fortinet SSL VPN weaknesses, especially the path traversal flaw CVE-2018-13379, which had already enabled the leak of credential-bearing session files from nearly 50,000 vulnerable devices worldwide. Those exposed sslvpn_websession files contained plaintext usernames and passwords, allowing attackers to reuse credentials even after patching. U.S. authorities said compromised access could support data exfiltration, ransomware-style encryption, and other post-exploitation activity, and highlighted indicators including FRP tunneling tools, unusual FTP traffic over port 443, and a scheduled task named SynchronizeTimeZone.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
On May 27, 2021, the FBI, coordinated with CISA, issued Alert MI-000148-MW on APT exploitation of Fortinet FortiOS vulnerabilities. The notice added indicators of compromise and post-exploitation details including suspicious accounts, FRP binaries, Mimikatz, MinerGate, WinPEAS, SharpWMI, FTP over port 443, and a scheduled task named "SynchronizeTimeZone."
As of at least May 2021, the FBI assessed that an APT group almost certainly exploited a FortiGate appliance to access a webserver hosting the domain of a U.S. municipal government. The actors likely created the username "elie" on the network to support further malicious activity.
On April 2, 2021, FBI and CISA published Joint Cybersecurity Advisory AA21-092A warning that APT actors were exploiting multiple Fortinet FortiOS vulnerabilities to gain initial access. The agencies said the activity likely targeted government, commercial, technology services, and critical infrastructure networks for follow-on attacks such as data exfiltration or encryption.
In March 2021, FBI and CISA observed APT actors scanning internet-facing devices on ports 4443, 8443, and 10443 for systems vulnerable to CVE-2018-13379. They also observed enumeration related to CVE-2020-12812 and CVE-2019-5591.
Fortinet published an additional customer warning recommending upgrades for CVE-2018-13379. The warning is referenced as occurring in July 2020.
Fortinet published a customer warning about the FortiOS SSL vulnerability and recommended upgrades. The article identifies this as one of several follow-up warnings after the PSIRT advisory.
Fortinet issued a PSIRT advisory for the FortiOS SSL VPN path traversal vulnerability CVE-2018-13379. This is cited as the vendor's initial warning to customers about the flaw.
A threat actor leaked sslvpn_websession files from almost 50,000 vulnerable Fortinet VPN devices, exposing plaintext usernames, passwords, access levels, and users' original IP addresses. The leak created risks of credential stuffing and renewed access to patched devices using still-valid credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcefortinet.com
Open sourceic3.gov
Open sourceic3.gov
Open sourcefortiguard.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large-scale campaign dubbed **FortiBleed** harvested credentials from internet-facing Fortinet devices, with researchers reporting stolen data from more than 70,000 to 75,000 devices across up to 194 countries and evidence that more than 430,000 FortiGate firewalls were targeted. SOCRadar said the operators used default or previously leaked credentials to access devices, deployed a custom packet-sniffing implant known as **FortiGate Sniffer**, captured VPN and other authentication data in real time, and in some cases left persistent backdoor accounts such as `adminin`. Open-source reporting and government alerts also tied the activity to Fortinet flaws including `CVE-2024-55591`, `CVE-2025-59718`, and `CVE-2025-59719`, while Fortinet disputed claims that the exposed credentials reflected a new product breach and said some data may have come from earlier compromises or brute-force activity. The stolen access was allegedly linked to the **INC** and **Lynx** ransomware ecosystems, with researchers citing exposed infrastructure, ransomware negotiation-panel artifacts, credential-stuffing systems, and cases where intrusions progressed to encryption of hundreds of endpoints. Reports said credentials belonging to UK government officials, Foreign Office staff, embassy personnel, NHS trusts, local councils, energy firms, and pharmaceutical suppliers were offered for sale on dark-web forums, raising concern over follow-on attacks against sensitive networks. National defenders including the UK NCSC and Brazil's CTIR Gov urged organizations using Fortinet firewalls and SSL VPNs to review accounts, remove unauthorized users, terminate sessions, reset passwords, enforce MFA, patch affected systems, and inspect logs for signs of compromise and lateral movement.
Aug 15, 2026
A suspected China-linked threat actor exploited **CVE-2022-42475**, a heap-based buffer overflow in Fortinet **FortiOS SSL-VPN**, as a zero-day to compromise internet-facing FortiGate devices in espionage operations. Reporting tied the activity to intrusions at a **European government entity** and an **Africa-based managed service provider**, with telemetry indicating exploitation began in **October 2022**, nearly two months before Fortinet released patches. The attackers deployed a custom backdoor named **BOLDMOVE**, including a Linux variant designed specifically for **FortiGate firewalls**. Investigators said the malware could tamper with device logging to reduce visibility and help the operators evade detection, and assessed the tradecraft as consistent with prior Chinese campaigns targeting perimeter security infrastructure such as **firewalls** and **IDS/IPS appliances** for long-term intelligence collection.
Aug 14, 2026
Attackers have been actively targeting internet-exposed **Fortinet FortiGate** management interfaces to seize administrative control of firewalls, with reporting tying the activity to exploitation of **`CVE-2024-55591`** and a related authentication weakness, **`CVE-2025-24472`**. Fortinet said the primary flaw affects **FortiOS** and **FortiProxy** and stems from improper authentication in the Node.js websocket module, allowing an unauthenticated remote attacker to obtain **super-admin** access and full control of vulnerable devices. Observed intrusions included the creation of new administrator accounts, adding those accounts to **SSL VPN** groups, changing firewall policies, and using the compromised appliances to pivot into networks that were otherwise protected behind the VPN perimeter. Security guidance accompanying the disclosures urged organizations to apply Fortinet patches immediately, disable or restrict public exposure of management interfaces, harden FortiOS devices, and review logs for signs of compromise tied to the broader campaign against exposed firewall consoles.
Jul 24, 2026