Threat-Hunting Guide Shows How to Detect Attacks on FortiGate Appliances
Summary
Wiz outlines how defenders can use agentless FortiGate logs to hunt for suspicious logins, rogue admin accounts, certificate and NAT changes, configuration theft, malicious scripts, and unusual network traffic.
Key points
- Virtual appliances are often internet-facing, highly privileged, and lack traditional endpoint agents, leaving defenders with limited visibility.
- Wiz's agentless workload detection collects and parses local FortiGate logs for threat hunting and incident investigation.
- The playbook details how to identify credential stuffing through failed and successful login events, unusual source IPs, and suspicious accounts.
- It recommends correlating logins with admin-account creation, certificate changes, NAT or port-forwarding modifications, and configuration downloads.
- FortiGate configuration exports can expose credentials and network details; attackers have used stolen configurations to access internal environments.
- FortiManager script deployments and unexpected local outbound traffic, including ICMP, can reveal backdoors, lateral movement, or command-and-control activity.
- The article describes enabling log ingestion and non-OS disk scanning to collect appliance logs in Wiz.
Article Details
- Defense Focus
- Use agentless collection and analysis of FortiGate and FortiManager logs to detect exploitation, credential abuse, persistence, configuration theft or tampering, suspicious network activity, and lateral movement.
- Detection Methods
- Correlate bursts of failed admin logins with successful logins, account lockouts, source IPs, login times, and expected geographic or account patterns.
- Detect new local super_admin accounts and correlate account creation with recent SSO or unusual login events; flag disabled MFA and unrestricted trusthost settings.
- Monitor local certificate additions, edits, or deletions and CLI certificate commands; correlate changes with suspicious logins, unexpected accounts, and maintenance windows.
- Flag FortiCloud SSO logins using unexpected or disposable email addresses and correlate them with SSO account creation or deletion.
- Detect new or modified VIP, DNAT, port-forwarding, and firewall-policy objects, especially unrestricted exposure or sensitive destination ports.
- Identify configuration downloads or show full-configuration commands by unexpected users, soon after suspicious logins or account creation, or in unusual volume.
- Monitor FortiManager script deployments for unexpected users, timing, target groups, directory traversal, shell commands, and references to /bin/ or /tmp.
- Hunt both forwarded and local traffic for unusual destinations, ports, protocols, external connections from the firewall, and unexpected ICMP traffic.
- Compare device type and operating system with observed network behavior to identify anomalous device activity.
- Data Sources
- FortiGate authentication logs, including login success, failure, and account-lockout events.
- FortiGate configuration-change, admin-action, certificate, VIP, firewall-policy, and configuration-download logs.
- FortiManager object-change and script-deployment logs.
- FortiGate local and forwarded traffic logs, including device type and operating-system fields.
- Cloud control-plane events and runtime signals correlated with appliance logs.
- Rule Types
- Wiz event queries for FortiGate and FortiManager events.
- Built-in threat-detection rules using correlated appliance logs.
- Platforms
- Wiz platform with Agentless Workload Detection.
- FortiGate appliances and FortiManager.
- Defensive Actions
- Enable Defend Agentless Workload Detection through the Preview Hub and verify workload or machine log ingestion in Event Management settings.
- Enable Non-OS disk scanning so FortiGate logs are collected.
- Review suspicious logins, newly created administrator accounts, certificate changes, configuration downloads, NAT changes, and script deployments together to establish event sequence and origin.
- Investigate unexpected local traffic from FortiGate devices as well as forwarded traffic through them.
- After a FortiGate compromise, rotate administrator credentials, API tokens, certificates, and other credentials integrated with the firewall, as recommended by the cited incident-response advisories.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
admin@attacker[.]local | Email value in the subject fields of an example attacker-generated FortiGate VPN certificate. | |
cloud-init@mail[.]io | Email pattern identified by the article as observed in FortiCloud SSO attacks. | |
cloud-noc@mail[.]io | Email pattern identified by the article as observed in FortiCloud SSO attacks. | |
support@openmail[.]pro | Disposable email address used in an observed FortiCloud SSO login preceding attacker-created administrator access. |
MITRE ATT&CK
T1003.006 · DCSyncAn AWS-documented campaign used stolen credentials to perform DCSync attacks.T1005 · Data from Local SystemAttackers downloaded or displayed FortiGate configuration files to obtain embedded credentials and network information.T1046 · Network Service DiscoveryThe article reports automated scanning of internal networks after attackers obtained and decrypted FortiGate configurations.T1078 · Valid AccountsAttackers authenticated to FortiGate devices using weak, default, or reused credentials, including successful SSO logins.T1095 · Non-Application Layer ProtocolThe CASTLETAP backdoor is described as using ICMP port knocking for covert command-and-control communication from compromised FortiGate devices.T1110.004 · Credential StuffingThe article describes credential-stuffing attempts against internet-facing FortiGate administrative and VPN login surfaces using leaked or reused credentials.T1136.001 · Local AccountAn observed FortiGate attack created a local administrator account with super_admin privileges for persistence.T1190 · Exploit Public-Facing ApplicationThe article describes exploitation of Fortinet vulnerabilities, including CVE-2026-24858 and CVE-2022-41328, against FortiGate or FortiManager systems.T1552.001 · Credentials In FilesThe article describes credentials, VPN pre-shared keys, and private keys embedded in FortiGate configuration files and decrypted by attackers.
CVE
CVE-2022-41328UNC3886 targeted FortiGate firewalls using CVE-2022-41328.CVE-2023-48788Salt Typhoon, a Chinese state-sponsored group, exploited vulnerabilities in Fortinet FortiClient EMS (CVE-2023-48788) to breach telecommunications networks.CVE-2024-23113Amazon Threat Intelligence reported a threat actor scanning Fortigate devices for use of default credentials and exploiting older vulnerabilities (including CVE-2024-55591 and CVE-2024-23113)CVE-2024-55591Amazon Threat Intelligence reported a threat actor scanning Fortigate devices for use of default credentials and exploiting older vulnerabilities (including CVE-2024-55591 and CVE-2024-23113)CVE-2026-24858Attackers recently exploited a zero-day in FortiOS (CVE-2026-24858) to authenticate, create local super-user accounts and delete logs to obscure movement.
Threat Actors
APT10The article explicitly links Earth Kasha to APT10.Earth KashaLinked by the article to APT10 and described as leveraging Fortinet vulnerabilities in campaigns against organizations in Japan and Taiwan.Salt TyphoonDescribed as a Chinese state-sponsored group that exploited a Fortinet FortiClient EMS vulnerability to breach telecommunications networks.UNC3886Reportedly compromised FortiManager and used script deployment to push backdoors to FortiGate devices; the article also describes its use of CASTLETAP and subsequent pivoting to ESXi hypervisors.
Malware
Vendors
FortinetFortiGate is Fortinet's series of next-generation firewalls (NGFW). It is widely deployed, with at least one instance found as a virtual appliance in 12% of cloud environments. Wiz Agentless Workload Detection fullyWizAgentless visibility, provided by Wiz, enables proper threat detection, incident investigation and threat hunting capabilities on these critical appliances.
Products
FortiClient EMSSalt Typhoon, a Chinese state-sponsored group, exploited vulnerabilities in Fortinet FortiClient EMS (CVE-2023-48788) to breach telecommunications networks.FortiGateFortiGate, an operative exampleFortiManagerLog ID 0021030002 - "CDB event log for object changed" (FortiManager) - Logs object changes pushed through FortiManager with subtype=objcfg.FortiOSAttackers recently exploited a zero-day in FortiOS (CVE-2026-24858) to authenticate, create local super-user accounts and delete logs to obscure movement.Wiz Agentless Workload Detectionwith at least one instance found as a virtual appliance in 12% of cloud environments. Wiz Agentless Workload Detection fully supports these devices, extending EDR-like visibility to FortiGate by collecting local
Tools
Countries
ChinaGoogle Threat Intelligence documented a campaign where UNC3886 (suspected China-nexus actor) compromised FortiManager and used script deployment to push backdoors to FortiGate devices. Scripts exploited CVE-2022-41328JapanEarth Kasha, linked to APT10, has leveraged Fortinet vulnerabilities in campaigns against organizations in Japan and TaiwanTaiwanEarth Kasha, linked to APT10, has leveraged Fortinet vulnerabilities in campaigns against organizations in Japan and Taiwan