Arctic Wolf Detects Surge in Automated Attacks Targeting Fortinet FortiGate Firewalls

Arctic Wolf has detected a new wave of automated attacks targeting Fortinet FortiGate devices since January 15, 2026. Attackers are making unauthorized configuration changes to firewalls, creating generic accounts to maintain persistence, enabling VPN access, and exfiltrating firewall configurations. This activity shows similarities to attacks observed in December 2025.