Give Me Your FortiGate Configuration Backup and I Rule Your Network

In a recent incident response case we were as always searching for the initial access. We have seen suspicious behavior from IP addresses that were assigned by the VPN. The respective public IP address was suspicious too, because it was owned by a VPS provider and was also listed in abuse databases. The most interesting part is how the attackers were able to authenticate to the VPN. Usually this happens by weak credentials of users, but these connections have been …

access address addresses backup behavior case configuration fortigate incident incident response initial access ip address ip addresses malware analysis network public response suspicious behavior vpn vps