This is not a software vulnerability exploitation campaign. The root cause is credential hygiene failure: use of default credentials, credential reuse across services, and the presence of Fortinet management interfaces exposed directly to the public internet. Once attackers authenticate with valid credentials, they operate with full administrative legitimacy, making detection through traditional signature-based controls difficult.

Post-authentication capabilities observed include monitoring and intercepting network traffic through the firewall, capturing additional credentials including VPN and user authentication data, extracting sensitive configuration data such as firewall rules, network topology, and VPN settings, and establishing persistent access for long-term operations.