FortiGate & GlobalProtect Perimeter Breach Campaign: 70,000 Credentials Exposed — Detection, Containment, and Remediation Guide

Introduction

Security researchers have disclosed a large-scale, ongoing campaign targeting exposed network edge devices—specifically Fortinet FortiGate firewalls and Palo Alto Networks GlobalProtect VPN gateways. Artifacts recovered from the investigation confirm that threat operators have obtained unauthorized access to numerous organizations worldwide and attempted to pivot deeper into victim networks. The campaign has already resulted in the exposure of over 70,000 credentials, creating an immediate risk of widespread unauthorized access, lateral movement, and follow-on ransomware or espionage operations.

This is not a theoretical threat. Edge devices sit at the trusted boundary of your network; a compromise here bypasses traditional perimeter defenses and provides attackers with a foothold inside your environment. Organizations running FortiGate or GlobalProtect appliances—especially those with management interfaces or VPN portals exposed to the internet—must assume breach until proven otherwise. This post provides the technical context, detection logic, and remediation steps required to identify compromise, contain the threat, and harden your perimeter against this campaign.

Technical Analysis

Affected Products and Platforms

• Fortinet FortiGate firewalls running FortiOS with SSL VPN or administrative interfaces exposed to the internet.
• Palo Alto Networks firewalls running PAN-OS with GlobalProtect VPN portals/gateways exposed.

While the news summary does not cite a specific CVE, the campaign pattern is consistent with recent exploitation of known edge-device vulnerabilities, weak or absent multi-factor authentication (MFA), and credential stuffing against management interfaces. Both vendors have released critical security updates throughout 2025 and 2026 addressing remote code execution, authentication bypass, and privilege escalation flaws in these exact product lines.

Attack Chain and Exploitation Requirements

The operators in this campaign are following a repeatable playbook:

1. Reconnaissance: Scanning for internet-facing FortiGate and GlobalProtect interfaces, often identifying vulnerable or unpatched versions.
2. Initial Access: Exploiting known vulnerabilities or leveraging weak authentication to gain administrative or VPN user-level access.
3. Credential Harvesting: Extracting local firewall databases, cached VPN credentials, Active Directory integration service accounts, and RADIUS/LDAP bind credentials stored on the device.
4. Persistence & Lateral Movement: Using stolen credentials to authenticate to internal services, establish secondary VPN tunnels, or deploy additional tooling. The researchers noted attempts to "further compromise some victims," indicating active post-exploitation activity.

Edge devices are high-value targets because they often store plaintext or weakly hashed credentials, maintain trust relationships with internal directory services, and are frequently excluded from endpoint detection and response (EDR) coverage.

Exploitation Status

• Confirmed active exploitation: Yes. This is an in-the-wild campaign with confirmed global victims.
• Scale: Over 70,000 credentials exposed across numerous organizations.
• Attribution: Not specified in the summary, but TTPs align with both financially motivated ransomware affiliates and state-aligned initial access brokers.

Defenders should treat any internet-exposed FortiGate or GlobalProtect device as potentially compromised and initiate threat hunting immediately.

Detection & Response

The following detection content is designed to surface the specific behaviors associated with this campaign: unusual authentication patterns on edge devices, suspicious process execution on firewall management interfaces, and post-compromise lateral movement using harvested credentials.

Sigma Rules

---
title: FortiGate / Palo Alto Suspicious Management Login
description: Detects logins to FortiGate or GlobalProtect management interfaces from unusual source IPs or outside business hours, consistent with campaign TTPs.
references:
  - https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html
author: Security Arsenal
date: 2026/10/15
logsource:
  product: fortinet
  service: sslvpn
  definition: 'VPN or admin login events'
detection:
  selection:
    eventtype: 'login'
    status: 'success'
  filter_known_admins:
    srcip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_known_admins
falsepositives:
  - Legitimate remote administration from unmanaged networks
level: high
---
title: Edge Device Credential Dumping Indicators
description: Detects command-line patterns associated with extracting configuration files or credential databases from FortiGate or Palo Alto firewalls via CLI/API.
references:
  - https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html
author: Security Arsenal
date: 2026/10/15
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\putty.exe'
      - '\plink.exe'
      - '\pscp.exe'
      - '\winscp.exe'
      - '\ssh.exe'
      - '\scp.exe'
  selection_cli:
    CommandLine|contains:
      - 'show full-configuration'
      - 'diagnose vpn ssl log filter'
      - 'execute backup'
      - 'request system software'
      - 'scp://'
      - 'ftp://'
      - 'tftp://'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate network administration and backup activities
level: medium
---
title: Internal Lateral Movement via Harvested VPN Credentials
description: Detects authentication attempts using VPN or service accounts from internal hosts that do not normally initiate such connections, a common post-compromise pattern.
references:
  - https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html
author: Security Arsenal
date: 2026/10/15
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventID: 4624
    LogonType: 3
    AccountName|contains:
      - 'vpn'
      - 'svc_'
      - 'service'
      - 'admin'
  filter_management_hosts:
    IpAddress|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_management_hosts
falsepositives:
  - Legitimate service account usage from application servers
level: high

KQL (Microsoft Sentinel / Defender)

The following query hunts for successful logins to FortiGate or Palo Alto devices from external or previously unseen IP addresses, followed by internal network connections using common administrative ports.

let Lookback = 14d;
let SuspiciousLogins = CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where DeviceVendor in ("Fortinet", "Palo Alto Networks")
| where DeviceProduct in ("FortiGate", "GlobalProtect")
| where DeviceEventClassID in ("login", "auth", "sslvpn-login", "globalprotect-auth")
| where DeviceAction =~ "success" or DeviceAction =~ "allowed"
| where SourceIP !startswith "10." and SourceIP !startswith "192.168." and SourceIP !startswith "172.16."
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), LoginCount=count() by SourceIP, DestinationIP, DestinationPort, DeviceVendor;
SuspiciousLogins
| join kind=inner (
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemotePort in (22, 3389, 445, 5985, 5986)
    | where ActionType == "ConnectionSuccess"
) on $left.DestinationIP == $right.RemoteIP
| project FirstSeen, LastSeen, SourceIP, DestinationIP, DestinationPort, DeviceVendor, LoginCount, LocalIP, RemotePort, InitiatingProcessCommandLine
| sort by LastSeen desc

Velociraptor VQL

Use this artifact to hunt for evidence of credential access or tunneling tools on endpoints that may have been used to interact with compromised edge devices.

-- Hunt for suspicious SSH, tunneling, and credential access tools on Windows endpoints
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(putty|plink|pscp|winscp|ssh|scp|nc|netcat|chisel|ligolo|sshuttle)'
   OR CommandLine =~ '(?i)(fortigate|globalprotect|panos|sslvpn|show full-configuration|execute backup)'
ORDER BY CreateTime DESC

Remediation Script

Run the following Bash script on Linux management hosts (or via SSH on the firewalls themselves where supported) to audit for suspicious sessions, unexpected configuration backups, and known-vulnerable firmware versions.

#!/bin/bash
# FortiGate / PAN-OS Edge Device Compromise Assessment
# Run on management station with API/SSH access to firewalls

FIREWALLS=("fw1.example.com" "fw2.example.com")
LOGFILE="edge_device_audit_$(date +%Y%m%d).log"

for FW in "${FIREWALLS[@]}"; do
    echo "=== Auditing $FW ===" | tee -a "$LOGFILE"
    
    # Check active sessions (FortiGate CLI example via SSH)
    echo "[*] Active admin/VPN sessions on $FW:" | tee -a "$LOGFILE"
    ssh -o ConnectTimeout=10 admin@$FW "get system session status" 2>/dev/null | tee -a "$LOGFILE"
    ssh -o ConnectTimeout=10 admin@$FW "diagnose vpn ssl list" 2>/dev/null | tee -a "$LOGFILE"
    
    # Check for recent configuration changes
    echo "[*] Recent configuration changes on $FW:" | tee -a "$LOGFILE"
    ssh -o ConnectTimeout=10 admin@$FW "execute log filter category event" 2>/dev/null | tee -a "$LOGFILE"
    ssh -o ConnectTimeout=10 admin@$FW "execute log display" 2>/dev/null | grep -i "config\|login\|backup" | tail -20 | tee -a "$LOGFILE"
    
    # Check firmware version (FortiGate)
    echo "[*] Firmware version on $FW:" | tee -a "$LOGFILE"
    ssh -o ConnectTimeout=10 admin@$FW "get system status" 2>/dev/null | grep -i "version" | tee -a "$LOGFILE"
    
    echo "" | tee -a "$LOGFILE"
done

echo "Audit complete. Review $LOGFILE for anomalies."

Remediation

1. Patch Immediately: Ensure FortiGate firewalls are running the latest FortiOS release and Palo Alto firewalls are on the latest PAN-OS content and software versions. Both vendors have released multiple critical updates in 2025 and 2026 addressing remote code execution and authentication bypass in SSL VPN and management interfaces. Subscribe to vendor PSIRT advisories and apply emergency patches within 24 hours of release.

2. Disable Unnecessary Exposure: Remove management interfaces (HTTPS, SSH, TELNET) and SSL VPN portals from the public internet unless absolutely required. If remote administration is necessary, restrict it to a jump host or VPN with MFA, and implement source IP allow-listing.

3. Enforce MFA Everywhere: Require multi-factor authentication for all administrative access and VPN connections. This single control would have prevented a significant portion of the credential abuse observed in this campaign.

4. Rotate All Credentials: Immediately reset all local firewall accounts, RADIUS/LDAP bind credentials, Active Directory service accounts used by the firewalls, and any VPN user credentials. Assume any credential stored on or transiting an exposed edge device is compromised.

5. Hunt for Persistence: Use the detection rules and queries above to search for unauthorized configuration changes, new admin accounts, unexpected firmware modifications, and anomalous authentication patterns. Pay special attention to logs from the past 90 days.

6. Segment and Monitor: Place edge devices in a dedicated management VLAN. Deploy network detection and response (NDR) or flow monitoring to alert on outbound connections from firewalls to unexpected destinations, and on inbound management attempts from non-corporate IP ranges.

7. Engage IR if Compromise is Suspected: If you detect unauthorized access, unusual credential extraction, or signs of lateral movement, activate your incident response plan immediately. Preserve firewall logs, memory captures, and configuration backups for forensic analysis.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub