New Campaign Targets FortiGate Firewalls with Unauthorized Config Changes

A fresh wave of automated cyberattacks is targeting FortiGate firewalls by exploiting unauthorized access to create backdoors and steal sensitive configuration data, according to Arctic Wolf researchers who have been tracking the campaign since mid-January 2026. The activity began on 15 January 2026 and is described as swift, automated, and aimed at establishing long-term persistence on compromised networks.

The attack vector centres on unauthorized SSO logins, with intrusions reportedly originating from a handful of hosting providers, enabling attackers to bypass standard authentication screens. Attackers typically log in as administrators using generic account names such as cloud-init@mail[.]io or cloud-noc@mail[.]io, then move rapidly to exfiltrate the firewall’s configuration file and create secondary administrative accounts for persistence.

The campaign bears resemblance to CVE-2025-59718 and CVE-2025-59719, but it remains unclear whether the latest activity exploits the same bugs or a new variant. Administrators are advised to disable FortiCloud SSO where possible, reset credentials if malicious logins are detected, and limit management interface access to trusted internal networks.