Automated FortiGate Attacks Exploit FortiCloud SSO to Alter Firewall Configurations

Arctic Wolf has warned of a new cluster of automated malicious activity targeting Fortinet FortiGate devices via FortiCloud SSO, with the activity beginning on 15 January 2026. According to Arctic Wolf, the campaign mirrors a December 2025 one that exploited CVE-2025-59718 and CVE-2025-59719 to achieve unauthenticated SSO bypass through crafted SAML messages on FortiCloud SSO-enabled devices, affecting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager.

The threat cluster involves creating generic accounts for persistence, granting VPN access, and exfiltrating firewall configurations, with malicious SSO logins recorded against a cloud-init@mail[.]io account from four IP addresses: 104.28.244[.]115, 104.28.212[.]114, 217.119.139[.]50 and 37.1.209[.]19.

Researchers have also observed the threat actors creating secondary accounts such as secadmin, itadmin, support, backup, remoteadmin and audit to ensure persistence, and installing automated activity that exports firewall configurations to the same IP addresses. Fortinet has been contacted for comment, and in the meantime Arctic Wolf advised disabling the admin-forticloud-sso-login setting to mitigate risk.