Full Report
Mapping FortiGate event logs to real-world campaigns: A step-by-step researcher’s guide to continuous agentless monitoring.
Analysis Summary
# Tool/Technique: FortiGate Exploitation & Post-Exploitation
## Overview
This entry covers the systematic targeting of FortiGate Virtual Appliances (Next-Generation Firewalls). Due to their role as internet-facing gateways with elevated privileges, they are frequently targeted by APTs for initial access, credential theft, and persistent network presence.
## Technical Details
- **Type**: Technique / Campaign (Specific to FortiGate/FortiOS)
- **Platform**: FortiOS, FortiClient EMS, Virtual Appliances (AWS, Azure, GCP)
- **Capabilities**: Credential harvesting, remote code execution (RCE), log manipulation, and unauthorized administrative access.
- **First Seen**: Variable (Significant campaigns noted in 2022-2026, including "FortiBleed")
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1190 - Exploit Public-Facing Application
- T1110.004 - Brute Force: Credential Stuffing
- T1078 - Valid Accounts
- **TA0003 - Persistence**
- T1136.001 - Create Account: Local Account
- **TA0005 - Defense Evasion**
- T1070.001 - Indicator Removal: Clear Windows Event Logs (Adapted for FortiOS Log Deletion)
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols
## Functionality
### Core Capabilities
- **Vulnerability Exploitation**: Leveraging zero-day and n-day vulnerabilities (e.g., CVE-2022-41328, CVE-2024-55591) to gain unauthorized shells.
- **Credential Harvesting**: Massive scanning for default credentials and exploiting "FortiBleed" to extract active session tokens or user databases.
- **Tunnelling**: Using the compromised appliance as a pivot point into the internal cloud or corporate network.
### Advanced Features
- **Log Obfuscation**: Targeted deletion of system/event logs to hide evidence of unauthorized logins or configuration changes.
- **Super-User Creation**: Automated creation of local administrative accounts to maintain persistence regardless of password resets on existing accounts.
- **Agentless Evasion**: Operates in "black box" environments where traditional EDR/Antivirus cannot be installed.
## Indicators of Compromise
- **File Hashes**: (Specific malware samples like GhostSpider vary; analysis of secondary payloads is required).
- **File Names**: `wp2shell` (associated with WordPress/FortiOS chains).
- **Network Indicators**:
- Scanning activity targeting ports 443 (SSL VPN) and 541 (FortiManager via FortiClient).
- Unexpected SSH or HTTPS traffic from foreign IPs to administrative interfaces.
- **Behavioral Indicators**:
- Creation of local "super-user" accounts without corresponding tickets.
- Identification of `log delete` or `log clear` commands in administrative history.
- Unexpected DNS or outbound traffic originating from the firewall appliance itself.
## Associated Threat Actors
- **UNC3886**: Known for targeting FortiGate for espionage.
- **Salt Typhoon**: Chinese state-sponsored group targeting telecommunications via FortiClient EMS.
- **Earth Kasha (APT10)**: Targeted organizations in Japan/Taiwan.
- **FortiBleed Campaign**: Actors responsible for compromising ~75,000 sets of credentials.
## Detection Methods
- **Behavioral Detection**: Monitoring FortiGate event logs for "Admin Login Failed" spikes (Credential Stuffing) or "User Created" events specifically for administrative roles.
- **Agentless Monitoring**: Utilizing cloud-native security platforms (e.g., Wiz) to ingest and parse local appliance logs that are not typically streamed to a SIEM.
- **Anomaly Detection**: Flagging unusual outbound network connections from the management interface.
## Mitigation Strategies
- **Patch Management**: Immediately apply updates for CVE-2024-23113, CVE-2024-55591, and CVE-2023-48788.
- **Hardening**: Disable administrative access (HTTPS/SSH) on internet-facing interfaces; use a dedicated management VPC or VPN.
- **Identity Security**: Enforce Multi-Factor Authentication (MFA) for all administrative and VPN accounts.
- **Log Outbound Traffic**: Export FortiGate local logs to an external, immutable log management system to prevent attackers from deleting evidence.
## Related Tools/Techniques
- **GhostSpider**: Malware used by Salt Typhoon post-compromise.
- **Credential Stuffing**: General methodology for gaining access via valid accounts.
- **Edge Device Exploitation**: Broader category including Ivanti, Citrix, and Cisco gateway compromises.