Threat Spotlight: Credential Theft vs. Admin Control—Two Devastating Paths to VPN Exploitation

### Executive summary This report details widespread and ongoing exploitation of VPN vulnerabilities—primarily Fortinet CVE-2018-13379 and CVE-2022-40684—highlighting mass credential theft, administrative takeover via automated PoCs, large-scale incidents (including a 15,000-device FortiGate data leak and Ghost ransomware activity across 70+ countries), and defensive recommendations such as patching, segmentation, MFA, API monitoring, and continuous detection validation.