A new wave of automated attacks targeting FortiGate firewall devices began on January 15, 2026, with threat actors using malicious scripts to steal network configurations and establish persistent access.
Cybersecurity firm Arctic Wolf identified the campaign, which creates unauthorized administrative accounts, modifies VPN settings, and systematically extracts firewall configurations from compromised devices.
Attack Methodology and Timeline
The intrusions follow a predictable pattern occurring within seconds, indicating fully automated exploitation.
Attackers first gain access through malicious Single Sign-On (SSO) logins, primarily targeting the [email protected] account.
Immediately after authentication, they download complete system configuration files through the management interface and create secondary persistence accounts such as secadmin, itadmin, support, backup, remoteadmin, and audit.
The campaign bears striking resemblance to activity observed in December 2025, which exploited two critical authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719).
These flaws allow unauthenticated attackers to bypass SSO authentication via crafted SAML messages when FortiCloud SSO is enabled on affected FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager devices.
Log entries showing successful SSO logins from these IP addresses, followed immediately by configuration downloads or administrative account creation, strongly indicate compromise.
Apply Security Updates: Monitor Fortinet’s official advisories and apply all security patches immediately upon release. Upgrade firmware following official documentation.
Reset Compromised Credentials: If malicious activity is detected, assume all credentials stored in exfiltrated configurations are compromised. Reset passwords promptly, as attackers can crack hashed credentials offline, particularly weak ones vulnerable to dictionary attacks.
Restrict Management Access: Limit firewall management interface access to trusted internal networks only. Public-facing management interfaces remain primary targets for mass exploitation campaigns.
Disable FortiCloud SSO: As a temporary workaround, disable the FortiCloud SSO feature by navigating to System → Settings and turning off “Allow administrative login using FortiCloud SSO,” or execute the CLI command: config system global → set admin-forticloud-sso-login disable → end.
Indicators of Compromise
| IOC | Type |
| [email protected] | Malicious account observed logging into firewall devices, downloading/exfiltrating a firewall config file |
| [email protected] | Malicious account observed logging into firewall devices, downloading/exfiltrating a firewall config file |
| 104.28.244[.]115 | Source IP observed in intrusions |
| 104.28.212[.]114 | Source IP observed in intrusions |
| 217.119.139[.]50 | Source IP observed in intrusions |
| 37.1.209[.]19 | Source IP observed in intrusions |
| secadmin | Account created following initial access |
| itadmin | Account created following initial access |
| support | Account created following initial access |
| backup | Account created following initial access |
| remoteadmin | Account created following initial access |
| audit | Account created following initial access |
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
