Attackers exploit FortiGate devices to access sensitive network information

Attackers are exploiting FortiGate firewall vulnerabilities and weak administrative credentials to obtain admin access, extract configuration files containing service and LDAP credentials, decrypt those credentials to authenticate to Active Directory, deploy RMM tools and malware, and exfiltrate domain-controller data (NTDS.dit); impacted sectors include healthcare, government, and managed service providers, and recommended mitigations include patching, strong admin controls, and extended log retention/forwarding to a SIEM for detection and response.