Threat hunts for Fortinet
3 hunts covering Fortinet, each with a hypothesis, the queries that test it and what the hunt cannot see.
3 hunts
-
high Part 2 of 2Research by Huntress
Unauthorized VPN Access via Stolen WatchGuard Credentials
Adversaries are using credentials stolen from lookalike WatchGuard VPN download sites to authenticate to corporate VPNs from anomalous geographic regions or hosting provider IP space.
3 query1 analytic1 checkpoint1 action2 taskcredential access · execution · initial access -
high Part 1 of 2Research by Huntress
WatchGuard VPN Lookalike Phishing and Payload Delivery
An adversary is using SEO poisoning to lead users to fake WatchGuard VPN download sites that harvest credentials via a JavaScript modal before delivering the legitimate, signed installer.
5 query2 analytic1 checkpoint1 action2 taskcredential access · execution · initial access -
criticalResearch by Unit 42
Fortinet Management Plane Exploitation and PEERSTITCH Deployment
An attacker has exploited a central management appliance to exfiltrate configurations and then used stolen credentials to deploy a memory-resident ARM64 implant on managed firewalls.
5 query2 analytic1 checkpoint1 action2 taskCVE-2024-47575 · CVE-2025-61624