Hackers Are Breaking Into FortiGate, FortiWeb and Palo Alto GlobalProtect Systems to Steal Passwords

Severity

Medium

Detail

Group-IB and NyxLab researchers have published an analysis detailing a wide-reaching cyber campaign targeting internet-facing firewalls and VPN systems. Attributed to an operator known as k0t, the operation searches for exposed edge infrastructure in bulk, attempting to break in through credential stuffing or known software vulnerabilities.

Investigating teams uncovered over 70,000 exposed credentials and associated LDAP records. Once access is gained to FortiGate, FortiWeb, or Palo Alto Networks GlobalProtect appliances, the threat actor extracts configuration files containing sensitive passwords to pivot deeper into corporate networks.

How?

The campaign combines automated discovery with targeted exploitation and credential harvesting to compromise edge infrastructure and establish persistent access:

• Targeting & Initial Access: The operators identify exposed network equipment using public scanning engines. On FortiWeb appliances, they exploit CVE-2025-64446, a relative path traversal flaw that allows unauthenticated administrative command execution. On Palo Alto Networks GlobalProtect portals and gateways, the threat actor attempts to leverage CVE-2026-0257, an authentication bypass flaw linked to specific cookie configurations. Against FortiGate firewalls, the actor executes credential-stuffing attacks using common username-password combinations.

• Credential Harvesting & Decryption: After gaining access to FortiGate devices, the operators download system configuration files containing stored credentials, including local administrator details and Active Directory/LDAP records. The actor decrypts these stored secrets by abusing a known default encryption key when custom private-data encryption is not configured.

• Lateral Movement & Persistence: Once inside the network, the operators deploy post-exploitation utilities like NetExec, Impacket, and Mimikatz alongside legitimate remote administration tools such as MeshCentral and Atera. In several incidents, researchers observed active device clusters controlled via MeshCentral servers, as well as data exfiltration to cloud storage via Rclone, with some victims ultimately appearing on ransomware leak sites.

Conclusion

The k0t campaign underscores the ongoing threat to internet-facing network appliances, where initial entry can yield administrative secrets capable of unlocking the entire corporate identity infrastructure. Security teams must recognize that patching an edge device is insufficient if configuration files and embedded credentials were exposed prior to remediation.

To defend against this campaign, organizations should restrict management access on FortiWeb, FortiGate, and GlobalProtect devices so interfaces are accessible only through trusted internal networks or jump hosts. Administrators must immediately patch CVE-2025-64446 and CVE-2026-0257, ensure private-data encryption is enabled with custom keys on FortiGate firewalls, and audit administrative account creation logs. Following any potential compromise, incident response teams must rotate all credentials stored on or linked to the appliance—including LDAP, Active Directory service accounts, and local administrative passwords—and inspect host logs for unauthorized remote management tools like MeshCentral or Rclone.

Source

https://cybersecuritynews.com/breaking-into-fortigate-fortiweb/