FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials

Researchers warn of an active campaign abusing FortiGate NGFW devices—via known CVEs and misconfigurations—to extract config files and service account credentials, which were then used to authenticate to Active Directory, enroll rogue workstations, deploy remote access tools, and exfiltrate NTDS.dit and SYSTEM hives (data sent to 172.67.196.232 over TCP/443). Targets include healthcare, government, and MSP environments; attackers demonstrated behaviors consistent with initial access brokers and possible pre-ransomware activity, while inadequate firewall logging hampered forensic visibility.