>
av.Amit VijayanCYBERSECURITY & RESEARCHLet\u2019s connect
Back to the library

Threat Hunting Playbooks

Patch the Box, Hunt the Tenant: Post-Patch Hunting on the Fortinet Edge

AV
Amit Vijayan
8 min read
Thumbnail for: Patch the Box, Hunt the Tenant: Post-Patch Hunting on the Fortinet Edge

On October 13, Fortinet shipped the CVE-2026-104286 fixes: 8.0.2, 7.6.7, 7.4.9. The 7.2 branch got none and won't — its path is 7.4.9 or above. Plenty of teams will read that, patch, and move on. That is the wrong stopping point.

The advisory's forensic section describes what happened before any patch existed: the archive234 exfil account, a dynamic-linker implant wired into every process. The patch closes the door; it does not escort out whoever already walked through it. Part 2's thesis in one sentence: patch now, but hunt for pre-patch compromise.

The FortiMail facts, refreshed

CVE-2026-104286 is a path-traversal plus null-byte flaw (CWE-22 + CWE-158) in FortiMail's Identity-Based Encryption component, CVSS 9.8, exploitable by an unauthenticated attacker over ordinary HTTP or HTTPS. Fortinet confirmed in-the-wild exploitation at disclosure on October 1; CISA added it to KEV the same day with a three-day federal deadline of October 4 and flagged forensic triage under BOD 26-04 — look for a breach, don't just patch. The flaw was found internally by Fortinet's own product security team, and no named actor has been publicly attributed as of this writing.

The published footprint is unusually specific. Two attacker IPs — 79.141.169.187 and 45.129.0.192 — log excerpts showing a root cron entry calling into /migadmin, seven SHA-256 file hashes, and appliance artifacts: a new /data/lib/liblog.so loaded into every process via /data/etc/ld.so.preload, a modified /bin/smit, a tampered /data/etc/httpd.conf. And the loudest artifact: an account named archive234 configured with remote server 79.141.169.187 and remote directory /uploads — archived mail staged for exfiltration. The log shows configuration, not a confirmed transfer: proof of intent, and your scope is mail data, not just the file write.

Censys puts roughly 2,800 FortiMail hosts internet-exposed (excluding honeypots), with Japan and Poland the largest shares. Every one of them had a window between whenever exploitation began and October 13 when nobody could patch even if they wanted to.

What lives in the pre-patch window: PEERSTITCH

Unit 42's PEERSTITCH report shows what the pre-patch window looks like from the inside: a memory-resident ARM64 implant on FortiGate firewalls, deployed by CL-STA-0954 (aka UNC5820) in a telecom MSP intrusion that began in September 2024 — a dwell measured in years, reported only now.

The chain is a complete course in edge compromise. The actors entered through CVE-2024-47575 ("FortiJump"), a FortiManager flaw that let them register a rogue appliance and exfiltrate running configs, crypto material, and SQLite databases covering 500+ managed FortiGates — their own and their clients'. From recovered credentials they opened unauthorized VPN sessions, then exploited CVE-2025-61624, a FortiOS system.auto-script path traversal, to escape the admin CLI to root. Note the scoring gap: Fortinet rates that flaw CVSS 6.0, "Medium," because it needs an admin session — which is exactly what the attacker already had. CISA KEV-listed it on October 16 (federal due October 19), flagged for forensic triage.

PEERSTITCH lives injected into /bin/miglogd and /bin/iked, bypassing security checks on tagged VPN sessions. There is no persistent binary on disk, no listening port, no independent outbound connection — it talks through the traffic of legitimate processes. They also impersonated FortiManager to pull configs from other hosts, then cleared crash logs and deleted rogue admins and auto-scripts. Unit 42's hunting guidance: check daemon memory for 16 KB RWX regions, NOP patches, cross-process /proc/mem access, and anomalous auto-script path-traversal objects.

FortiBleed: the compromise that isn't a CVE at all

On October 6, the FBI and U.S. Secret Service issued JCSA-20261006-01 on FortiBleed, an active credential-harvesting campaign holding working administrative credentials for 86,644 FortiGate firewalls and SSL VPN gateways across 194 countries (SOCRadar-verified). There is no CVE. The campaign stuffs leaked credentials and infostealer logs at scale, cracks legacy SHA-256 FortiOS hashes offline on rented GPU infrastructure, and feeds transit-harvested credentials from a custom Golang sniffer back into the scanner.

The operators create rogue administrator accounts with convincing names and, in confirmed cases, delete the originals — locking legitimate admins out of their own firewalls. Validated access is sold to ransomware affiliates — at least 12 intrusions from INC/Lynx and Payload affiliates, across all 16 US critical-infrastructure sectors. The FBI's remediation goes past patching: restrict external management access, terminate sessions, reset credentials, enforce phishing-resistant MFA, and audit accounts, configs, logs, API keys, and password storage. Mechanical detail worth knowing: after a FortiOS upgrade, legacy SHA-256 hashes stay in place until each administrator logs in again. A fully patched box is still crackable from an old hash dump if nobody re-authenticated.

Named credential origins close the loop: prior incidents FG-IR-26-060 and FG-IR-25-647, plus CVE-2026-24858 and CVE-2025-59718, supplied the reused credentials. Old breaches, monetized today.

The rest of the month's Fortinet surface

Two more, briefly. CVE-2025-25249 is an unauthenticated heap-buffer overflow in the CAPWAP daemon (cw_acd, UDP 5246); Fortinet patched it in January 2026 (FG-IR-25-084), CISA KEV-listed it September 9 with forensic triage, and Russian-speaking actors have exploited it since at least July to deploy the PivotC2 Node.js RAT — 178 confirmed infections. Another scoring split: Fortinet says CVSS 7.4, NVD says 9.8. And on October 13, Fortinet disclosed CVE-2026-107656, a CWE-288 auth bypass in the FortiSandbox GUI (CVSS 9.6, FG-IR-26-185) with known exploitation marked "No." Watch item, not a fire.

For scale: the /news/ exposure tracker currently counts 383,743 internet-exposed FortiGates. That is the population these campaigns recruit from.

The hunt: three checks worth running this week

Hypothesis: if a Fortinet edge device was compromised during a pre-patch window or a credential campaign, you'll find one of: published FortiMail IOC infrastructure or artifacts, a FortiGate admin account you didn't create, or edge-implant indicators — before downstream ransomware or mail-exfil impact.

Hunt 1 — FortiMail pre-patch IOC sweep (KQL + Splunk)

Scope to 45+ days. The advisory gives no start date for exploitation, so assume the worst.

// CVE-2026-104286: IOC sweep over the pre-patch window
let ioc_ips = dynamic(["79.141.169.187", "45.129.0.192"]);
union DeviceNetworkEvents, DeviceFileEvents
| where Timestamp > ago(45d)
| where RemoteIP in (ioc_ips)
    or InitiatingProcessCommandLine has_any (ioc_ips)
| project Timestamp, DeviceName, ActionType, RemoteIP, FileName, FolderPath
| order by Timestamp desc

index=syslog sourcetype=fortimail (archive234 OR "remote directory" OR "/uploads" OR migadmin OR "ld.so.preload")
| stats earliest(_time) as first_seen, latest(_time) as last_seen, count by host, user
| sort -count

And the traversal/null-byte probes against your FortiMail IPs, because internet-wide scanning for this was certain:

index=proxy OR index=firewall dest_ip IN (<your FortiMail IPs>)
  (url="*%00*" OR url="*..%2f*" OR url="*%2e%2e*" OR url="*ibe*")
| stats count, values(url) as sample_urls by src_ip, dest_ip, status

Any archive/forwarding account you didn't create means the appliance is compromised until proven otherwise — and the scope is mail-data exfiltration.

Hunt 2 — The FortiGate rogue-admin audit (FortiBleed posture)

This one is a process, not a query, and it belongs in your runbook quarterly at minimum. From FortiOS CLI or a config backup:

get system admin          # list every admin account
show system admin         # full config: trusted hosts, auth method, profile
diagnose sys admin list   # currently active admin sessions

Diff the admin list against your known-good inventory — the FortiBleed operators used convincing service-account-style names, so eyeball the list, don't just grep for "admin." Force re-authentication of all admins, terminate active sessions, and rotate VPN pre-shared keys, LDAP bind credentials, and certificates. In FortiAnalyzer or Splunk, hunt for admin-account creation and privilege-profile changes: those are the T1136 events of this campaign.

Hunt 3 — Implant indicators on the appliance itself

On an edge appliance, filesystem and running state are the ground truth. Diff show system auto-script against a known-good baseline — unexpected auto-scripts are the CVE-2025-61624 foothold. Look for /tmp/.i.js or fortirun.bin artifacts (PivotC2), unexpected outbound TLS or reverse SSH from the firewall itself, and Unit 42's process anomalies (RWX memory regions in daemons, cross-process /proc/mem access). FortiGate filesystems rarely change outside upgrades; treat any unexplained change as hostile.

Mapped techniques: T1190 (public-facing exploitation), T1136 (rogue admin creation), T1048 (archive exfil), T1110.003/T1110.004 (FortiBleed spraying/stuffing), T1078 (valid-account abuse), T1531 (account lockout).

Defensive takeaways

  1. Patch + triage, never patch-only. BOD 26-04's forensic-triage-before-remediation is the assume-breach posture this class of device demands. Patch 8.0.2 / 7.6.7 / 7.4.9 now (7.2 users: migrate to 7.4.9+); then run the hunts above over the pre-patch window.
  2. Inventory your Fortinet edge as an attack surface. 383,743 exposed FortiGates is the recruiting pool; any internet-reachable admin or VPN portal is in scope for no-CVE credential campaigns.
  3. Close the credential gap mechanically. After every FortiOS upgrade, force admin re-authentication (kills legacy SHA-256 exposure), enforce phishing-resistant MFA on admin and VPN access, and audit the admin list on a cadence — rogue accounts are the persistence mechanism.
  4. Distrust the score on edge boxes. CVSS 6.0 on the FortiOS flaw and Fortinet's 7.4-vs-NVD's 9.8 on the CAPWAP flaw both hid root-implant outcomes. A "medium" on the box that terminates your VPN is not medium.
  5. The pattern compounds. Ivanti's in-memory chain (Part 1), PEERSTITCH, PivotC2, FortiBleed — the edge is where compromise is built to outlive the patch. Series rule of thumb: if the device is reachable, assume the window started before you were looking, and prove otherwise with logs.

Further reading

Keep exploring.

All articles