FortiGate Devices Exploited in Attacks to Breach Networks and Steal Credentials
Cybersecurity researchers have uncovered a new wave of attacks in which threat actors are exploiting FortiGate firewall devices as entry points into targeted networks. These devices, commonly used to secure enterprise environments, are being abused to gain unauthorized access, allowing attackers to infiltrate organizations across sectors such as healthcare, government, and managed service providers. The campaign highlights how critical infrastructure components can become prime targets when misconfigured or left vulnerable.
Once inside, attackers are able to extract sensitive information, including service account credentials and detailed network configurations. By obtaining this data, they can deepen their access, impersonate legitimate users, and move laterally across systems. In some cases, threat actors have been observed creating unauthorized accounts and maintaining persistence within compromised environments, making detection and removal more difficult.
The attacks often take advantage of weaknesses in authentication systems and exposed management interfaces, which allow adversaries to bypass security controls or log in using stolen or weak credentials. These techniques enable them to retrieve firewall configuration files, decrypt stored data, and uncover critical infrastructure details such as VPN settings and administrative access points. This level of insight significantly increases the potential impact of a breach.
Security experts warn that these incidents reflect a broader trend in cyberattacks, where edge devices like firewalls and VPN gateways are increasingly targeted as initial access points. Because these systems sit at the perimeter of networks and often handle sensitive authentication processes, compromising them can provide attackers with a powerful foothold. The findings emphasize the importance of strong access controls, timely patching, and continuous monitoring to defend against evolving threats.
