FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials

The Hacker News

March 10, 2026 at 4:21 PM

Actively Exploited

Overview

Cybersecurity researchers have reported a new trend where attackers are using FortiGate Next-Generation Firewall devices as gateways to infiltrate networks. These breaches are occurring through the exploitation of recently identified vulnerabilities or by taking advantage of weak passwords. Once inside, the attackers extract configuration files that contain sensitive service account credentials and details about the network's layout. This is concerning because it opens up pathways for further attacks within the affected networks. Organizations using FortiGate devices need to be aware of this threat and take immediate action to secure their systems.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: FortiGate Next-Generation Firewall appliances
Action Required: Organizations should implement strong password policies, regularly update their FortiGate devices, and monitor for unusual activity.
Timeline: Newly disclosed

Original Article Summary

Cybersecurity researchers are calling attention to a new campaign where threat actors are abusing FortiGate Next-Generation Firewall (NGFW) appliances as entry points to breach victim networks. The activity involves the exploitation of recently disclosed security vulnerabilities or weak credentials to extract configuration files containing service account credentials and network topology

Impact

FortiGate Next-Generation Firewall appliances

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should implement strong password policies, regularly update their FortiGate devices, and monitor for unusual activity. Specific patch numbers or updates were not mentioned.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

FBI says even in an AI-powered world, security basics still matter

CyberScoop

The FBI has issued a statement emphasizing that while artificial intelligence is accelerating the pace of cyber attacks, the core nature of these attacks remains unchanged. Jason Bilnoski, an official with the FBI, pointed out that traditional security measures are still essential, despite the advancements in technology. This serves as a reminder to organizations and individuals that basic cybersecurity practices, such as strong passwords and regular software updates, are crucial for protection against evolving threats. The FBI's message is particularly relevant as cybercriminals increasingly use AI to enhance their tactics, making it imperative for everyone to stay vigilant and adhere to established security protocols. Neglecting these fundamentals can lead to significant vulnerabilities, regardless of technological advancements.

Mar 10, 2026

Attackers exploit FortiGate devices to access sensitive network information

Security Affairs

Attackers are targeting FortiGate devices to infiltrate networks and steal sensitive configuration data, including service account credentials and network information. Researchers from SentinelOne have identified that these breaches often occur due to vulnerabilities or weak login credentials associated with FortiGate devices. Once attackers gain access to a corporate network, they can extract configuration files that may expose critical information. This poses a significant risk to organizations that rely on FortiGate for network security, as compromised credentials can lead to further exploitation. Companies using FortiGate devices should prioritize reviewing their security practices and updating configurations to prevent unauthorized access.

Mar 10, 2026

Federal judge blocks Perplexity’s AI browser from making Amazon purchases

CyberScoop

A federal judge has ruled that Perplexity's AI browser cannot make purchases on Amazon, following a lawsuit filed by Amazon last year. The lawsuit accused Perplexity of computer fraud, claiming that its AI browser accessed password-protected accounts to buy items without authorization. This decision is significant as it addresses the legal implications of AI technology interacting with online marketplaces. The ruling raises questions about the ethical use of AI in e-commerce and the protection of user accounts. It also highlights the ongoing legal battles surrounding AI capabilities and their potential for misuse.

Mar 10, 2026

Critical defect in Java security engine poses serious downstream security risks

CyberScoop

A critical vulnerability has been identified in the Java security engine, specifically within the pac4j library, which is widely used for authentication and authorization in web applications. While researchers have not yet seen active exploitation of this flaw in real-world scenarios, the ease with which attackers could exploit it raises significant concerns. This vulnerability could impact a range of applications that rely on pac4j, potentially exposing sensitive user data and compromising security protocols. Developers and organizations using pac4j need to assess their systems and prepare for potential updates or patches to mitigate this risk.

Mar 10, 2026

APT28 conducts long-term espionage on Ukrainian forces using custom malware

Security Affairs

APT28, a Russian hacking group also known as Fancy Bear, has been conducting long-term espionage against Ukrainian military personnel using custom malware called BEARDSHELL and COVENANT. This campaign has been active since April 2024, allowing the attackers to maintain ongoing surveillance on military activities. ESET, the cybersecurity firm that reported on this incident, has highlighted the sophistication of the malware and the group's history of targeting government and military organizations. The implications of this espionage are significant, as it compromises the security and operational integrity of Ukrainian forces during a time of conflict. This incident showcases the persistent threat posed by state-sponsored cyber actors in geopolitical tensions.

Mar 10, 2026

Ericsson Breach Exposes Data of 15k Employees and Customers

Infosecurity Magazine

Ericsson has reported a data breach that has potentially compromised the personal information of about 15,000 employees and customers. The breach occurred due to a security vulnerability in a third-party service provider, which allowed unauthorized access to sensitive data. As a result, affected individuals might face risks such as identity theft or fraud. This incident raises concerns about the security measures companies have in place for their third-party vendors and the importance of rigorous vetting processes. Companies and users alike should be vigilant in monitoring their accounts for any suspicious activity following this breach.

Mar 10, 2026