UNC5820 exploiting FortiManager flaw (Campaign)

Researchers identified active exploitation of a FortiManager zero-day (CVE-2024-47575) by UNC5820 beginning June 2024; the flaw in the fgfmd daemon enabled remote arbitrary command execution and was used to exfiltrate FortiGate configuration data (including credentials and policies). Compromised devices produced compressed files containing IP addresses and serial numbers and established outbound connections following file creation, with Fortinet issuing mitigations and updates to address the issue.