FortiGate Firewalls Hacked by Automated Attacks to Ste

A new wave of automated attacks is actively targeting FortiGate firewall devices. Since January 15, 2026, threat actors have been observed executing unauthorized configuration changes, establishing persistence through generic accounts, and exfiltrating sensitive firewall configuration data.

This campaign echoes a December 2025 incident involving malicious SSO logins shortly after Fortinet disclosed critical vulnerabilities CVE-2025-59718 and CVE-2025-59719.

Arctic Wolf notes that initial access methods remain unconfirmed, but the tactics mirror prior SSO abuse. Detections are active, alerting customers to suspicious activity. Fortinet has yet to confirm if existing patches fully mitigate this wave.

In early December 2025, Fortinet issued FG-IR-25-647, detailing two critical authentication bypass flaws. Attackers craft malicious SAML messages to bypass SSO login when FortiCloud SSO is enabled.

Post-disclosure, Arctic Wolf observed SSO logins on admin accounts, followed by config dumps and persistence. It’s unclear if the January attacks leverage the same flaws or patched variants.

Attack Chain

Arctic Wolf’s telemetry indicates that the attacks are highly automated, with multiple stages of the kill chain occurring within seconds of one another.

1. Initial Access: Malicious SSO logins are initiated from specific hosting provider IP addresses. The primary account used for these intrusions is [email protected].
2. Exfiltration: Immediately following the login, the attacker triggers a download of the system configuration file via the GUI interface to the same source IP.
3. Persistence: To maintain access, the attackers create secondary administrative accounts. Common usernames observed include secadmin, itadmin, and remoteadmin.

Logs indicate that the time delta between the login, the configuration export, and the account creation is negligible, confirming the use of automated scripts.

Indicators of Compromise

Monitor these IOCs for signs of compromise:

Mitigations

Fortinet users should monitor official advisories and apply patches promptly (upgrade guide). Reset all credentials if activity matches—hashed creds can be cracked offline.

Restrict management interfaces to trusted internal networks, a best practice against mass scans. As a workaround, disable FortiCloud SSO:

textconfig system global
set admin-forticloud-sso-login disable
end

Organizations should hunt for these IOCs and review FortiGate logs immediately.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.