Stolen Service Accounts Lead to Rogue Workstations and Deep AD Compromise

Reported 11 Mar 2026 by otx · Severity: medium

SentinelOne's DFIR team has responded to multiple incidents involving compromised FortiGate NGFW appliances used to establish footholds in targeted environments. Attackers exploited vulnerabilities or weak credentials to access FortiGate devices, extract configuration files conta