FortiGate Edge Device Compromise Leads to AD Takeover

SentinelOne DFIR investigated multiple incidents in early 2026 where attackers compromised FortiGate Next-Generation Firewall appliances to gain initial access into enterprise environments. Exploitation of Fortinet vulnerabilities allowed attackers to extract configuration files containing encrypted service account credentials. Once decrypted, these credentials were used to authenticate to AD and establish deeper access. Threat actors created rogue domain workstations, deployed remote management tools, and attempted credential harvesting from domain controllers. The activity demonstrates how compromised network edge devices can become a pivot point for full domain compromise and data exfiltration.

Severity: Critical

Threat Details

Incident 1: Stealthy Persistence & Rogue Workstations

• Initial Access: Attackers gained administrative access to FortiGate appliances primarily through SSO authentication vulnerabilities and weak credential exposure.

Likely occurred in late November 2025. The attacker created a local admin account named “support” and 4 new firewall policies to maintain a foothold.

• Credential Harvesting: In February 2026, the actor decrypted the FortiGate configuration to steal fortidcagent LDAP credentials.
• Lateral Movement: The attacker joined two rogue workstations (WIN-X8WRBOSKOOF and WIN-YRSXLEONJY2) to the AD using the mS-DS-MachineAccountQuota attribute.
• Discovery: Used SoftPerfect Network Scanner for enumeration and attempted password spraying from the appliance IP.

Incident 2: Rapid Escalation & Data Theft

• Initial Access: Attackers accessed the organization’s FortiGate appliance and created a local admin account named ssl-admin.
• Credential Harvesting: Stole Domain Administrator credentials from the configuration file.
• Execution & Persistence:
  • Logged into servers via RDP within 10 minutes of initial access.
  • Deployed RMM tools Pulseway and MeshAgent to establish a deeper foothold.
  • Used DLL side-loading (masking malware as Java files) to execute payloads.
• Exfiltration: Created a Volume Shadow Copy of the Primary Domain Controller to extract the NTDS.dit file and SYSTEM registry hive, likely exfiltrating them via a Cloudflare-owned IP.

Vulnerabilities & Exploitation Methods

Recommendations

1. Organizations should ensure that all FortiGate appliances are running the latest firmware versions and immediately apply patches for vulnerabilities associated with the attack, including CVE-2025-59718, CVE-2025-59719, and CVE-2026-24858.
2. Alert on Log ID 0100032095, which signals that the system configuration file containing sensitive service account credentials has been exported.
3. Search for Log ID 0100032001 (successful SSO admin login) and verify if the usernames match known malicious patterns like cloud-init[@]mail[.]io or cloud-noc[@]mail[.]io.
4. Alert on Log ID 0100044547 (object attribute configured) where the configuration path is user.local or system.admin, as attackers often create “backdoor” accounts like support or ssl-admin.
5. Analyze VPN Tunnel Logs: Correlate Log ID 0101039424 (SSL VPN up) or Log ID 0101037138 (IPsec tunnel up) with the remip field to identify the attacker’s source IP for further tracking.
6. Monitor for Windows Event ID 4741 (Computer account created). This is a high-fidelity alert if the Subject: Security ID matches a FortiGate LDAP service account rather than a legitimate admin.
7. Audit Directory Service Changes: Enable advanced auditing to watch for Event ID 5136, which can show missing Service Principal Names (SPNs) or modified User Account Control (UAC) values, indicators of automated tools like Impacket.
8. Identify Malicious Computer Objects: Regularly query AD for new computer objects where the mS-DS-CreatorSID belongs to the Fortinet LDAP service account or where SPNs are suspiciously absent.
9. Look for the use of WMIC to create Volume Shadow Copies.
10. Block the IOCs at their respective controls
    https://www.virustotal.com/gui/collection/6105363c88b239ab97e6876eb0967261cb7be0d9aef706d9f93828215b34d65c/iocs

IOCs

Mitre Att&Ck

Source:

• https://www.sentinelone.com/blog/fortigate-edge-intrusions/

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn

No related posts found.