Fortinet Firewall Fiasco: When Hackers Play Peekaboo with Your Security
Threat hunters are spotlighting a new campaign targeting Fortinet FortiGate firewalls with public-facing management interfaces. These digital mischief-makers have been logging unauthorized admin access and creating super admin accounts like they’re collecting trading cards. A key red flag? Extensive use of the jsconsole interface from some sketchy IP addresses.
Hot Take:
Looks like Fortinet FortiGate firewalls have been caught with their management interfaces down, thanks to a mysterious new campaign from cybercriminals. If your firewall’s management interfaces are exposed to the internet, it’s like putting up a “Welcome Hackers” sign on your network. Time to lock those doors before someone helps themselves to all your data!
Key Points:
- Threat actors targeted Fortinet FortiGate firewalls with exposed management interfaces.
- The attackers created super admin accounts to alter firewall configurations.
- SSL VPN access was exploited for lateral movement using DCSync.
- The campaign likely involved a zero-day vulnerability.
- Targeting was indiscriminate, affecting a wide range of organization profiles.
Already a member? Log in here