According to the advisory, the activity is ongoing rather than historical, meaning organizations running affected FortiGate systems should treat this as an active threat. The core impact described is administrative lockout: once intruders gain a foothold, they can modify credentials and access controls so that real admins are shut out, complicating both detection and recovery.

Because the source material does not provide specific CVE identifiers or affected version numbers for this campaign, administrators should rely on Fortinet's own guidance and the FBI's bulletin for authoritative technical details rather than any third-party list of identifiers.

Recommended steps to reduce exposure include:

• Restrict management and SSL VPN interfaces from direct internet access wherever possible, placing them behind a VPN or allowlist instead.
• Apply the latest Fortinet security updates and firmware for your FortiGate devices without delay.
• Audit administrator accounts for unexpected additions or changed credentials.
• Enable multi-factor authentication for all administrative access.
• Review logs for signs of tampering, such as altered configs or unexplained login activity.

Given that lockouts are the reported outcome, having offline backups of device configurations and a tested recovery plan is worth prioritizing. If you suspect a device has already been compromised, isolating it from the network before attempting remediation helps prevent further unauthorized changes.

Source: Unknown

Has anyone here already reviewed their FortiGate admin access and MFA settings in response to this warning?