FortiGate Firewall Exploitation Fuels Network Breaches in New Attack Wave

Security teams observed active exploitation of FortiGate Single Sign-On and other FortiOS vulnerabilities allowing attackers to obtain administrative access, download and decrypt device configuration files to harvest AD service account credentials, create local administrative accounts on compromised appliances, join rogue workstations, perform password spraying and network enumeration, deploy RMM tools (Pulseway, MeshAgent) via cloud-hosted Java-sideloaded payloads, and steal NTDS.dit using Volume Shadow Copy; the report includes IoCs (domains, IPs, URLs, hostnames), recommended mitigations (patching, centralized log retention and monitoring), and detection guidance.