Zero-Day Security Bug Likely Fueling Fortinet Firewall Attacks

Researchers at Arctic Wolf have identified an ongoing, opportunistic campaign targeting publicly exposed Fortinet FortiGate management interfaces (firmware versions ~7.0.14–7.0.16), likely exploiting an undisclosed zero-day to perform jsconsole logins, modify firewall configurations, create accounts, alter SSL VPN settings, and extract credentials (including via DCSync); organizations are advised to avoid exposing management interfaces, keep firmware patched, and enable syslog monitoring.