Skip to content

FortiGate Firewall Exploitation Campaign

alt text

FortiGate NGFW Credential Theft AD Pivoting Network Intrusion

Overview

Researchers identified a campaign targeting Fortinet FortiGate Next-Generation Firewall (NGFW) appliances to gain initial footholds into enterprise networks. Attackers exploit vulnerable or weakly protected internet-exposed management interfaces and then extract firewall configuration data containing sensitive credentials and topology intelligence.

Post-compromise activity includes unauthorized admin creation, policy manipulation, and credential-based pivoting into internal identity infrastructure such as Active Directory.

Technical Specifications

Attribute Details
Target Platform Fortinet FortiGate NGFW appliances
Initial Access Paths Exploited vulnerabilities and weak/reused admin credentials
Referenced CVEs CVE-2025-59718, CVE-2025-59719, CVE-2026-24858
Post-Access Actions Rogue admin creation, policy changes, config export
Sensitive Data Exposure LDAP credentials, AD service account credentials, network topology
Privilege Escalation Path Stolen service accounts used for internal authentication
Lateral Movement Risk High (firewall-to-AD-to-internal assets)
Campaign Objective Deep network access for persistence, reconnaissance, and follow-on operations

Affected Products

  • FortiGate NGFW devices with exposed management interfaces
  • FortiOS deployments lacking recent security patches
  • Environments using weak/reused firewall administrative credentials
  • Networks where firewall config stores reusable service-account secrets
  • Status: Active exploitation pattern requiring immediate hardening

Technical Details

Initial Compromise Vectors

  • Internet-exposed management interfaces are scanned and targeted.
  • Attackers exploit known vulnerabilities or authenticate with weak/reused credentials.

Post-Compromise Device Manipulation

  • New administrator accounts (for example, support) are created for persistence.
  • Firewall policies are modified to reduce segmentation controls and broaden access.
  • Device configuration files are exported for offline credential and topology extraction.

Credential and Identity Abuse

  • Extracted configuration material may contain LDAP/AD service account credentials.
  • Stolen credentials can be used to authenticate into Active Directory.
  • AD access enables broader reconnaissance, remote access deployment, and lateral movement.

Attack Scenario

  1. Reconnaissance:

    • Attacker identifies reachable FortiGate management interfaces.

  2. Initial Access:

    • Vulnerability exploitation or credential-based login succeeds.

  3. Persistence Setup:

    • Rogue admin account is created and privileged access retained.

  4. Configuration Theft:

    • Firewall config is downloaded and parsed for secrets/topology data.

  5. Internal Pivot:

    • Stolen service credentials are used against AD/internal systems.

  6. Network Expansion:

    • Attacker deploys tools, scans internal assets, and prepares for exfiltration or ransomware-style operations.

Impact Assessment

  • Exposure of network architecture, firewall policies, and credential material
  • Theft of AD/LDAP service account secrets enabling deeper access
  • Increased data exfiltration risk from internal systems
  • Unauthorized firewall policy changes and trust boundary erosion
  • Creation of rogue administrative identities for persistent control
  • Potential tampering with internal security controls and monitoring paths
  • Elevated risk of business disruption from broad intrusion activity
  • Potential ransomware deployment after identity and network compromise
  • Service instability if segmentation and policy controls are maliciously altered

Mitigation Strategies

Patch and Exposure Reduction

  • Apply latest FortiOS security patches immediately
  • Remove direct internet exposure for management interfaces
  • Restrict admin access to trusted internal management networks/VPN only

Identity and Credential Security

  • Enforce MFA for all firewall administrative access
  • Rotate and harden service account credentials stored/used by firewall-integrated services
  • Eliminate credential reuse across management tiers

Monitoring and Detection

  • Monitor firewall logs for unexpected admin account creation and configuration exports
  • Alert on anomalous policy changes and unusual management login sources
  • Deploy network/EDR detections for post-firewall pivot behavior into AD/internal systems

Resources and References

Open-Source Reporting

Last Updated: March 12, 2026