Sophisticated Cyberattacks Infiltrate Fortinet FortiGate Appliances, Exfiltrating Critical Network Configurations

A persistent and evolving cyber campaign is actively exploiting critical vulnerabilities within Fortinet’s widely deployed FortiGate network security appliances, leading to the unauthorized creation of administrative accounts and the exfiltration of sensitive firewall configurations and potentially other content. This orchestrated attack, first identified in mid-January, represents a significant threat to organizations relying on Fortinet’s perimeter defense solutions, underscoring the critical importance of robust patch management and vigilant network monitoring in the face of sophisticated threat actors.

Fortinet FortiGate devices serve as foundational pillars in modern enterprise network infrastructure, acting as advanced firewalls, VPN concentrators, and intrusion prevention systems. Their strategic position at the network perimeter makes them high-value targets for adversaries seeking to gain deep access into corporate environments. The current wave of attacks leverages an as-yet-undisclosed vulnerability, alongside potential bypasses for previously patched flaws, to compromise these critical security gateways. The observed activity, characterized by its rapid execution and consistent methodology, strongly suggests automated tooling, indicating a scalable and well-resourced adversary.

The initial phase of the campaign, documented by cybersecurity intelligence firms, commenced around January 15th. Attackers are specifically targeting the Single Sign-On (SSO) feature within FortiGate devices. SSO, designed to streamline user authentication across multiple applications, can become a critical weak point if vulnerabilities are present. In this instance, the attackers are exploiting an unknown flaw within the SSO mechanism to forge or bypass authentication, enabling them to establish rogue administrative accounts with privileged access, including VPN capabilities. Within mere seconds of gaining initial access, these accounts are then used to export the entire firewall configuration data. This swift exfiltration process is a hallmark of automated attack frameworks, designed to maximize compromise efficiency before detection.

This latest campaign exhibits striking similarities to incidents observed in December following the public disclosure of two critical authentication bypass vulnerabilities: CVE-2025-59718 and CVE-2025-59719. These flaws were specifically identified as impacting Fortinet products, particularly when FortiCloud SSO features were enabled. CVE-2025-59718, in particular, allowed unauthenticated attackers to circumvent SSO authentication on vulnerable FortiGate firewalls by crafting malicious Security Assertion Markup Language (SAML) messages. SAML is an XML-based standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP), in this case, FortiCloud and the FortiGate device. A flaw in its implementation can allow an attacker to impersonate a legitimate user or administrative entity, gaining unauthorized access without valid credentials.

A critical concern arising from the current exploitation is the uncertainty surrounding the efficacy of existing patches. While Fortinet had previously released updates, including FortiOS 7.4.9 in early December, to address CVE-2025-59718 and CVE-2025-59719, reports from the cybersecurity community suggest that the latest observed threat activity might not be fully mitigated by these patches. Fortinet customers have reported that even after updating their devices to what was considered the most recent secure version, FortiOS 7.4.10, their firewalls remained susceptible to compromise. This indicates a potential patch bypass or a newly discovered vulnerability closely related to the previously identified flaws, complicating mitigation efforts for affected organizations. The vendor is reportedly preparing further updates, including FortiOS 7.4.11, 7.6.6, and 8.0.0, to definitively resolve these lingering security gaps.

The implications of stealing firewall configurations are profound. A firewall configuration file is a blueprint of an organization’s network security posture. It contains critical information such as:

• Network Topology: Details about internal IP ranges, subnets, and network segmentation.
• Security Policies: Rules governing traffic flow, allowed/blocked ports, protocols, and services.
• VPN Configurations: Information on VPN tunnels, peer IPs, encryption keys (potentially), and user access.
• User Accounts: Local administrative accounts, their privileges, and potentially hashed credentials.
• Service Configurations: Details of various network services, NAT rules, and logging settings.

With this level of detail, attackers can gain an unparalleled understanding of the target network. This knowledge can be leveraged for a variety of malicious purposes, including:

• Internal Reconnaissance: Mapping out the network to identify high-value targets, critical systems, and data repositories.
• Bypassing Defenses: Crafting targeted attacks that exploit known vulnerabilities in internal systems or bypass existing security rules.
• Establishing Persistence: Setting up backdoors, creating new legitimate-looking accounts, or modifying existing configurations to maintain access.
• Lateral Movement: Using VPN access or internal network knowledge to move deeper into the compromised environment.
• Data Exfiltration: Identifying locations of sensitive data and planning its extraction.
• Disruption: Modifying or disabling security rules to facilitate ransomware deployment or destructive attacks.

Forensic analysis of compromised systems has revealed consistent Indicators of Compromise (IOCs). Logs from affected Fortinet customers show the creation of new administrative users subsequent to an SSO login originating from "[email protected]" from the IP address 104.28.244.114. These specific markers align precisely with observations made by cybersecurity intelligence firms during their analysis of the ongoing FortiGate attacks and earlier exploitation instances documented in December. The consistency of these IOCs across multiple incidents reinforces the coordinated and automated nature of the attacks, suggesting a single, or closely related, threat actor group.

Given the active and sophisticated nature of these attacks, immediate mitigation steps are paramount for organizations utilizing Fortinet FortiGate devices. Until a definitive and fully effective patch is released and widely deployed, administrators are strongly advised to disable the vulnerable FortiCloud SSO login feature. This can be achieved through the device’s graphical user interface by navigating to System -> Settings and switching "Allow administrative login using FortiCloud SSO" to "Off." Alternatively, the same configuration change can be implemented via the command-line interface (CLI) using the following commands:

config system global
set admin-forticloud-sso-login disable
end

Disabling this feature temporarily removes the attack vector that leverages the FortiCloud SSO mechanism, thereby significantly reducing the immediate risk of compromise. However, this is a temporary workaround and not a long-term solution, as it may impact legitimate user workflows that rely on FortiCloud SSO. Organizations must remain vigilant for official Fortinet advisories and be prepared to apply new patches as soon as they become available.

The scope of potential exposure is substantial. Internet security watchdogs, such as Shadowserver, are actively monitoring the landscape and have identified nearly 11,000 Fortinet devices globally that are exposed online and have FortiCloud SSO enabled, making them potential targets for this ongoing campaign. This wide attack surface underscores the urgency of the situation and the need for widespread awareness and swift action.

Furthermore, the Cybersecurity and Infrastructure Security Agency (CISA) has recognized the severity of this vulnerability. CVE-2025-59718 was added to CISA’s "Known Exploited Vulnerabilities Catalog" on December 16th, a critical designation that signifies active exploitation in the wild. This listing triggered a directive for all federal civilian executive branch agencies to patch affected systems within a week, highlighting the national security implications of such critical flaws in widely used network infrastructure. This CISA directive serves as a strong recommendation for all public and private sector organizations to prioritize the patching and mitigation of this vulnerability.

The ongoing Fortinet FortiGate attacks highlight several critical lessons for cybersecurity resilience:

1. Complexity of Patching: Even after a vendor releases a patch, the possibility of bypasses or related, unaddressed vulnerabilities remains, necessitating continuous vigilance and verification.
2. Supply Chain Risk: Reliance on a single vendor for critical network components introduces a single point of failure that, when compromised, can have cascading effects across an organization.
3. Importance of Layered Security: While perimeter devices are crucial, effective defense requires multi-factor authentication (MFA) on all administrative interfaces, network segmentation, robust logging, and continuous threat monitoring.
4. Proactive Threat Intelligence: Organizations must actively consume and act upon threat intelligence from cybersecurity firms and government agencies to stay ahead of evolving attack methodologies.

The silence from Fortinet regarding the current wave of attacks, despite multiple inquiries from the press, adds to the anxiety among its customer base. A clear and timely communication strategy from vendors during active exploitation events is vital for enabling customers to protect themselves effectively. As the cybersecurity landscape continues to evolve, the relentless targeting of critical network infrastructure like FortiGate devices underscores the persistent challenge of securing digital assets against increasingly sophisticated and automated threats. Organizations must treat every perimeter breach as a serious incident requiring immediate and comprehensive incident response, understanding that the exfiltration of firewall configurations can be a precursor to deeper, more damaging network compromises. The full extent of this compromise and its long-term implications will continue to unfold as investigations progress and new threat intelligence emerges.