Mass Exploitation of FortiGate Devices Underway

Security researchers are warning of widespread exploitation campaigns targeting Fortinet FortiGate firewalls. The Shadowserver Foundation estimates over 50,000 devices have been compromised globally.

Campaign Overview

The attacks leverage a combination of vulnerabilities:

• CVE-2024-21762: Authentication bypass (patched Dec 2024)
• CVE-2025-47889: Configuration exposure (patched Oct 2025)
• Attackers are chaining these for persistent access

Scale of Exploitation

According to Shadowserver Foundation data:

Attack Chain

Researchers have documented the typical attack flow:

1. Initial Access: Exploit CVE-2024-21762 for authentication bypass
2. Persistence: Create hidden admin accounts
3. Configuration Theft: Extract VPN credentials and firewall rules
4. Lateral Movement: Use stolen VPN creds for network access
5. Long-term Access: Install persistent backdoors

Indicators of Compromise

Suspicious Admin Accounts

Check for unexpected administrative users:

# Look for accounts created after compromise date
# Common malicious usernames observed:
- support_tech
- fgt_admin
- system_backup
- maintenance

Modified Files

# Files commonly modified:
/data/config/current-config
/data/etc/admin-pass
/data/lib/libauth.so

Detection Steps

1. Review all admin accounts and their creation dates
2. Audit VPN user logs for anomalies
3. Check for configuration changes
4. Review outbound connections from firewall
5. Verify firmware hasn't been modified

Fortinet's Response

Fortinet has issued updated guidance:

• Verify running latest firmware version
• Enable and review audit logging
• Implement network segmentation
• Consider temporary VPN disable if suspected compromise

Recommended Actions

Immediate

1. Update to latest FortiOS version
2. Audit all administrator accounts
3. Rotate all administrative credentials
4. Review recent configuration changes

Short-term

1. Enable comprehensive logging
2. Implement configuration backup monitoring
3. Deploy network detection capabilities
4. Review firewall rules for unauthorized changes

If Compromised

1. Isolate affected devices
2. Preserve forensic evidence
3. Reset to factory and restore known-good config
4. Assume VPN credentials are compromised

Patch Information

Expert Analysis

"Organizations need to treat firewall compromises as full network compromises," warned a threat researcher. "Attackers gaining access to firewall configurations have visibility into the entire network architecture."

Sources: Fortinet PSIRT, Shadowserver Foundation, BleepingComputer