Massive campaign to compromise FortiGate equipment

Fortinet develops network security equipment, including FortiGate firewalls, intended to secure networks against intrusions and attacks. They include SSL VPN functionality allowing users to establish secure connections remotely using the SSL/TLS protocol. On June 16, 2026, SOCRadar researchers identified the operational infrastructure of a group of attackers leading a compromise campaign targeting equipment belonging to companies, telecom operators, healthcare establishments, universities and critical infrastructure. The attack relies on a fully automated process of scanning the Internet to identify accessible VPN and Fortinet admin interfaces, then using credentials from previous compromises to carry out brute force and credential stuffing attacks. Valid username/password combinations are automatically verified, after which compromised devices are used as listening points to intercept and collect other usernames passing through the network. These new identifiers are then reinjected into the attack cycle, allowing the compromise campaign to continually expand. This compromise would allow a malicious actor to use legitimate administrative access to sneak into internal networks and take full control of the security perimeter.

• Fortinet FortiGate devices (NGFW firewalls and SSL VPN gateways) exposed to the Internet and/or using default passwords or credentials from previous compromises;

RECOMMENDED ACTIONS:

• Check the organization's exposure via the FortiBleed fingerprint analysis portals made available by the community (SOCRadar, Hudson Rock);
• Perform a review of all accounts on affected systems;
• Restrict access to the firewall administration interface from the internet so that it is only accessible from the internal network;
• Disable the SSL VPN functionality if it is not essential;
• Force rotation of all passwords for all VPN administrator and user accounts;
• Enable and mandate multi-factor authentication (MFA) for all remote and administrative access;