Attackers Exploit FortiGate Appliances to Access Networks and Steal Service Account Credentials
Summary
SentinelOne reports attackers used FortiGate vulnerabilities or weak credentials to access networks, obtain LDAP service-account credentials, and, in some cases, deploy remote tools and exfiltrate Active Directory files.
Key points
- SentinelOne reported targeting of healthcare, government, and managed service provider environments through FortiGate vulnerabilities—including CVE-2025-59718, CVE-2025-59719, and CVE-2026-24858—or weak credentials.
- In one reported case, attackers created a local administrator account and permissive firewall policies on a FortiGate appliance in November 2025.
- SentinelOne said a later attacker likely extracted the appliance configuration and used decrypted fortidcagent LDAP credentials to authenticate to Active Directory and enroll rogue workstations.
- Network scanning led to detection of that activity and halted further lateral movement, according to the report.
- In another case, attackers deployed Pulseway and MeshAgent and downloaded malware via PowerShell from AWS infrastructure.
- Java malware launched through DLL side-loading was used to exfiltrate NTDS.dit and the SYSTEM registry hive to an external server over port 443.
- SentinelOne said it found no use of harvested credentials between collection and incident containment.
Article Details
- Attack Vectors
- Attackers exploited FortiGate vulnerabilities or weak credentials to access appliances and extract configuration files containing service-account credentials and network topology.
- Attackers created a local administrator account and permissive firewall policies, then used service-account credentials to authenticate to Active Directory and enroll rogue workstations.
- In one incident, attackers deployed Pulseway and MeshAgent, downloaded malware from an AWS cloud storage bucket using PowerShell, and used Java DLL side-loading to exfiltrate NTDS.dit and the SYSTEM hive.
- Defensive Notes
- In the reported incident involving Active Directory access, detection during network scanning halted further lateral movement.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 172[.]67[.]196[.]232 | External server identified as the destination for exfiltration of NTDS.dit and the SYSTEM hive. |
MITRE ATT&CK
T1005 · Data from Local SystemThe Java malware accessed the NTDS.dit file and SYSTEM registry hive for exfiltration.T1046 · Network Service DiscoveryThe attackers initiated network scanning after enrolling rogue workstations in Active Directory.T1059.001 · PowerShellPowerShell was used to download malware from a cloud storage bucket.T1078 · Valid AccountsThe attacker authenticated to the victim environment using credentials from the fortidcagent service account.T1105 · Ingress Tool TransferThe attackers downloaded malware from a cloud storage bucket to the victim environment.T1136.001 · Local AccountThe attackers created a local administrator account named “support” on a FortiGate appliance.T1552.001 · Credentials In FilesThe attackers extracted service-account credentials from a FortiGate configuration file after decrypting it.T1562.004 · Disable or Modify System FirewallThe attackers added firewall policies allowing the “support” account to traverse all zones without restrictions.T1574.002 · DLL Side-LoadingThe Java malware was launched through DLL side-loading.
CVE
CVE-2025-59718Fortinet · FortiOS; Fortinet · FortiProxy; +2 more#FortiGate #CVE-2025-59718 #CVE-2025-59719 #CVE-2026-24858 #fortidcagent #ActiveDirectory #Pulseway #MeshAgent #NTDS.ditCVE-2025-59719Fortinet · FortiWeb; Siemens · RUGGEDCOM APE1808#FortiGate #CVE-2025-59718 #CVE-2025-59719 #CVE-2026-24858 #fortidcagent #ActiveDirectory #Pulseway #MeshAgent #NTDS.ditCVE-2026-24858Fortinet · FortiAnalyzer; Fortinet · FortiManager; +5 more#FortiGate #CVE-2025-59718 #CVE-2025-59719 #CVE-2026-24858 #fortidcagent #ActiveDirectory #Pulseway #MeshAgent #NTDS.dit
People
Alex DelamotteNamed as a security researcher who discussed FortiGate appliance access and its connection to authentication infrastructure in SentinelOne's campaign reporting.Amey PatneNamed as a security researcher who discussed FortiGate appliance access and its connection to authentication infrastructure in SentinelOne's campaign reporting.Mary Braden MurphyNamed as a security researcher who discussed FortiGate appliance access and its connection to authentication infrastructure in SentinelOne's campaign reporting.Stephen BromfieldNamed as a security researcher who discussed FortiGate appliance access and its connection to authentication infrastructure in SentinelOne's campaign reporting.
Products
Fortinet FortiGateResearchers warn of a campaign abusing FortiGate NGFW appliances—exploiting recent CVEs and weak credentials—to steal configuration files and gain footholds in networks across healthcare, government, and managed serviceMicrosoft Active Directorydecrypted service-account LDAP credentials (fortidcagent), enrolled rogue workstations into Active Directory, and in some cases deployed Pulseway/MeshAgent and Java DLL side-loading to exfiltrate NTDS.dit and
Tools
MeshAgent(fortidcagent), enrolled rogue workstations into Active Directory, and in some cases deployed Pulseway/MeshAgent and Java DLL side-loading to exfiltrate NTDS.dit and the SYSTEM hive via AWS-hosted infrastructure.Pulseway(fortidcagent), enrolled rogue workstations into Active Directory, and in some cases deployed Pulseway/MeshAgent and Java DLL side-loading to exfiltrate NTDS.dit and the SYSTEM hive via AWS-hosted
Industries
Governmentand weak credentials—to steal configuration files and gain footholds in networks across healthcare, government, and managed service providers.Healthcarerecent CVEs and weak credentials—to steal configuration files and gain footholds in networks across healthcare, government, and managed service providers.Managed service providerssteal configuration files and gain footholds in networks across healthcare, government, and managed service providers.