Arctic Wolf detects surge in automated Fortinet FortiGate firewall configuration attacks

Arctic Wolf observed a wave of automated malicious activity starting January 15, 2026, against Fortinet FortiGate devices that involved exploiting recent SSO authentication bypass vulnerabilities to perform malicious SSO logins, create persistent admin accounts, enable VPN access, and export firewall configurations (including hashed credentials); Arctic Wolf published detections and IoCs and is monitoring the evolving campaign.