New Campaign Targets FortiGate Firewalls with Unauthorized Config Changes

Arctic Wolf has observed an active, automated campaign (since Jan 15, 2026) targeting FortiGate firewalls through unauthorized SSO logins that rapidly download firewall configuration files and create secondary administrative accounts for persistence. The activity mirrors exploitation of authentication-bypass CVEs disclosed in late 2025, uses generic admin-like account names (e.g., [email protected], [email protected], secadmin), and aims to steal hashed credentials and network configurations; recommended mitigations include disabling FortiCloud SSO, resetting credentials, and restricting management interface access.