FortiGate Firewalls Hacked by Automated Scripts to Steal Sensitive Network Configurations

A new wave of automated attacks targeting FortiGate firewall devices began on January 15, 2026, with threat actors using malicious scripts to steal network configurations and establish persistent access.

Cybersecurity firm Arctic Wolf identified the campaign, which creates unauthorized administrative accounts, modifies VPN settings, and systematically extracts firewall configurations from compromised devices.

Attack Methodology and Timeline

The intrusions follow a predictable pattern occurring within seconds, indicating fully automated exploitation.

Attackers first gain access through malicious Single Sign-On (SSO) logins, primarily targeting the cloud-init@mail.io account.

Immediately after authentication, they download complete system configuration files through the management interface and create secondary persistence accounts such as secadmin, itadmin, support, backup, remoteadmin, and audit.

The campaign bears striking resemblance to activity observed in December 2025, which exploited two critical authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719).

These flaws allow unauthenticated attackers to bypass SSO authentication via crafted SAML messages when FortiCloud SSO is enabled on affected FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager devices.

Log entries showing successful SSO logins from these IP addresses, followed immediately by configuration downloads or administrative account creation, strongly indicate compromise.

Apply Security Updates: Monitor Fortinet’s official advisories and apply all security patches immediately upon release. Upgrade firmware following official documentation.

Reset Compromised Credentials: If malicious activity is detected, assume all credentials stored in exfiltrated configurations are compromised. Reset passwords promptly, as attackers can crack hashed credentials offline, particularly weak ones vulnerable to dictionary attacks.

Restrict Management Access: Limit firewall management interface access to trusted internal networks only. Public-facing management interfaces remain primary targets for mass exploitation campaigns.

Disable FortiCloud SSO: As a temporary workaround, disable the FortiCloud SSO feature by navigating to System → Settings and turning off “Allow administrative login using FortiCloud SSO,” or execute the CLI command: config system global → set admin-forticloud-sso-login disable → end.

Indicators of Compromise

IOC	Type
cloud-init@mail.io	Malicious account observed logging into firewall devices, downloading/exfiltrating a firewall config file
cloud-noc@mail.io	Malicious account observed logging into firewall devices, downloading/exfiltrating a firewall config file
104.28.244[.]115	Source IP observed in intrusions
104.28.212[.]114	Source IP observed in intrusions
217.119.139[.]50	Source IP observed in intrusions
37.1.209[.]19	Source IP observed in intrusions
secadmin	Account created following initial access
itadmin	Account created following initial access
support	Account created following initial access
backup	Account created following initial access
remoteadmin	Account created following initial access
audit	Account created following initial access

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.