High

A newly observed wave of highly automated malicious activity is actively targeting FortiGate firewall devices, with activity beginning around January 15, 2026. Threat actors have been seen performing unauthorized configuration changes, creating new administrative accounts to maintain persistence, and exfiltrating sensitive firewall configuration files. This activity closely mirrors a December 2025 campaign that followed Fortinet’s disclosure of two critical FortiCloud SSO authentication bypass vulnerabilities, CVE-2025-59718 and CVE-2025-59719. While Fortinet has since confirmed active exploitation of the FortiCloud SSO bypass, it remains unclear whether the January attacks rely on the same flaws or on modified techniques that bypass existing patches.

Researcher indicates that the attacks are fully automated, with multiple stages of the attack chain occurring within seconds. Initial access is believed to involve malicious SSO logins originating from specific hosting provider IP addresses, most commonly using the account cloud-init@mail[.]io. Immediately after successful access, attackers download the full system configuration via the FortiGate GUI, effectively exfiltrating sensitive data such as network topology, credentials, and security policies. This rapid sequence strongly suggests scripted exploitation rather than manual attacker interaction.

Following configuration theft, the attackers establish persistence by creating additional administrative-level accounts on compromised devices. Frequently observed usernames include secadmin, itadmin, remoteadmin, support, backup, and audit, enabling long-term access even if the original entry point is closed. Arctic Wolf reports that the time gap between login, configuration export, and account creation is negligible, reinforcing confidence that this is a coordinated, multi-stage automated campaign rather than isolated incidents.

Defenders are advised to urgently monitor for known Indicators of Compromise, including malicious email-based admin accounts, suspicious SSO login activity, and source IPs such as 104.28.244[.]115, 104.28.212[.]114, 217.119.139[.]50, and 37.1.209[.]19. Mitigation steps include applying the latest Fortinet patches, resetting all credentials if compromise is suspected (as configuration files may allow offline password cracking), and restricting management interfaces to trusted networks only. As an immediate workaround, organizations can disable FortiCloud SSO to reduce exposure, while actively reviewing FortiGate logs and hunting for persistence accounts across their environments.