SentinelOne Unmasks Exploitation of FortiGate Appliances as Gateways to Network Takeover

SentinelOne DFIR investigations reveal FortiGate NGFW appliances being actively compromised via high-severity authentication/SSO vulnerabilities and weak credentials; attackers extracted reversible configuration files to harvest service accounts, created local admin accounts, pivoted into Active Directory (including NTDS.dit extraction), and used RMM abuse and DLL side‑loading to maintain persistence—activities attributed to initial access brokers, ransomware groups, and state-aligned actors.