New campaign targets Fortinet FortiGate/FortiWeb and Palo Alto GlobalProtect to harvest stored passwords and move laterally

A new cybersecurity campaign is actively targeting Fortinet FortiGate and FortiWeb devices and Palo Alto Networks GlobalProtect portals. Attackers exploit the devices to harvest stored passwords from configurations and move laterally within victim networks, with the activity linked to a specific operator.

Detected & updated continuously · Source: Nebula