Know What's Happening in Defense

FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials

Threat actors are exploiting FortiGate next‑generation firewalls to gain initial access and harvest service‑account credentials. Researchers identified abuse of recent CVEs (2025‑59718, 2025‑59719, 2026‑24858) and misconfigurations to extract configuration files containing LDAP and AD service accounts, targeting healthcare, government and MSP environments. In one case, attackers created a local “support” admin account, deployed new firewall policies, and later used decrypted credentials to infiltrate Active Directory and enroll rogue workstations. The campaign also involved deploying remote‑access tools and exfiltrating NTDS.dit and SYSTEM hive via AWS PowerShell scripts.