Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls

Arctic Wolf Labs observed an active campaign exploiting publicly exposed FortiGate management interfaces—likely a zero-day later confirmed as CVE-2024-55591—where attackers used anomalous jsconsole logins (including spoofed loopback and DNS resolver IPs) to create super-admin accounts, modify SSL VPN portals to establish tunnels from VPS providers, and perform DCSync for credential harvesting; the report includes timelines, IoCs, TTP mappings, detection recommendations, and remediation advice (disable public management interfaces and patch firmware).