FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials

Cybersecurity researchers are calling attention to a new campaign where threat actors are abusing FortiGate Next-Generation Firewall (NGFW) appliances as entry points to breach victim networks.

The activity involves the exploitation of recently disclosed security vulnerabilities or weak credentials to extract configuration files containing service account credentials and network topology information, SentinelOne said in a report published today. The security outfit said the campaign has singled out environments tied to healthcare, government, and managed service providers.

"FortiGate network appliances have considerable access to the environments they were installed to protect," security researchers Alex Delamotte, Stephen Bromfield, Mary Braden Murphy, and Amey Patne said. "In many configurations, this includes service accounts which are connected to the authentication infrastructure, such as Active Directory (AD) and Lightweight Directory Access Protocol (LDAP)."

"This setup can enable the appliance to map roles to specific users by fetching attributes about the connection that’s being analyzed and correlating with the Directory information, which is useful in cases where role-based policies are set or for increasing response speed for network security alerts detected by the device."

However, the cybersecurity company noted that such access could be exploited by attackers who break into FortiGate devices through known vulnerabilities (e.g., CVE-2025-59718, CVE-2025-59719, and CVE-2026-24858) or misconfigurations.

In one incident, the attackers are said to have breached a FortiGate appliance in November 2025 to create a new local administrator account named "support" and used it to set up four new firewall policies that allowed the account to traverse all zones without any restrictions.

The threat actor then kept periodically checking to ensure the device was accessible, an action consistent with an initial access broker (IAB) establishing a foothold and selling it to other criminal actors for monetary gain. The next phase of the activity was detected in February 2026 when an attacker likely extracted the configuration file containing encrypted service account LDAP credentials.

"Evidence demonstrates the attacker authenticated to the AD using clear text credentials from the fortidcagent service account, suggesting the attacker decrypted the configuration file and extracted the service account credentials," SentinelOne said.

The attacker then leveraged the service account to authenticate to the victim's environment and enroll rogue workstations in the AD, allowing them deeper access. Following this step, network scanning was initiated, at which point the breach was detected, and further lateral movement was halted.

In another case investigated in late January 2026, attackers swiftly moved from firewall access to deploying remote access tools like Pulseway and MeshAgent. In addition, the threat actor downloaded malware from a cloud storage bucket via PowerShell from Amazon Web Services (AWS) infrastructure.

The Java malware, launched via DLL side-loading, was used to exfiltrate the contents of the NTDS.dit file and SYSTEM registry hive to an external server ("172.67.196[.]232") over port 443.

"While the actor may have attempted to crack passwords from the data, no such credential usage was identified between the time of credential harvesting and incident containment," SentinelOne added.

Delamotte told The Hacker News that the company's Digital Forensics and Incident Response (DFIR) has observed similar techniques used in other cases, such as staging files in the USOShared paths. This likely suggests a wider campaign where FortiGate devices are not always used for initial access.

There is currently no evidence that the two aforementioned incidents are the work of the same threat actor, given the differences in the post-compromise techniques used.

"For example, the first incident we describe involved joining rogue attacker workstations to the AD," Delamotte added. "The other incident followed a multi-chain lateral movement operation that aligns with pre-ransomware activity. We were unable to conclude that it was the goal, as the attacks were blocked before any later-stage payloads were deployed."

The findings are yet another reminder that threat actors of varied motivations are actively targeting perimeter devices, turning them into prime initial access pathways for deeper compromises into enterprise networks. A common aspect that ties the two incidents together is the lack of adequate logging on the firewalls, preventing an understanding of how and when the attackers exactly gained initial access.

Organizations are recommended to ensure they have at least 14 days of log retention, as well as send all logs to a Security Incident and Event Monitoring (SIEM) to tackle scenarios where an attacker may delete them from a local machine in an attempt to cover up their tracks.

"NGFW appliances have become ubiquitous because they provide strong network monitoring capabilities for organizations by integrating security controls of a firewall with other management features, such as AD," it added. "However, these devices are high-value targets for actors with a variety of motivations and skill levels, from state-aligned actors conducting espionage to financially motivated attacks such as ransomware."

(The story was updated after publication to include additional insights from SentinelOne.)

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.