Cybersecurity researchers have identified a significant surge in brute-force attacks targeting Fortinet's SSL VPN systems, with over 780 unique IP addresses participating in coordinated efforts on August 3, 2025. This unprecedented volume marks the highest daily attack rate recorded in recent months, raising alarms about potential vulnerabilities within Fortinet's infrastructure. According to GreyNoise, which monitors internet-wide scanning activity, such concentrated spikes in malicious traffic often precede the disclosure of new vulnerabilities affecting the same vendor, with 80% of similar cases historically followed by announcements within six weeks. 'New research shows spikes like this often precede the disclosure of new vulnerabilities affecting the same vendor,' warned GreyNoise. The attack appears deliberate, as it specifically targeted FortiOS profiles, indicating the attackers' familiarity with Fortinet's systems.
The attack manifested in two distinct waves: the first on August 3, 2025, primarily targeting FortiOS, and the second occurring on August 5, which shifted focus to FortiManager systems using different TCP signatures. GreyNoise noted that the attacks were not opportunistic but rather exhibited a focused approach. The data revealed that the majority of malicious traffic originated from countries such as the United States, Canada, Brazil, and Russia, with Hong Kong emerging as a notable target in recent weeks. 'Critically, the observed traffic was also targeting our FortiOS profile, suggesting deliberate and precise targeting of Fortinet's SSL VPNs,' GreyNoise stated.
Experts indicate that this activity could signify the exploitation of previously unknown vulnerabilities. 'This was not opportunistic -- it was focused activity,' emphasized GreyNoise, suggesting that the attackers may be utilizing the same infrastructure or toolset to pivot between different Fortinet services. The implications of such targeted attacks could be profound, as they may lead to data breaches or unauthorized access to sensitive networks.
In response to the escalating threat, the security community has begun to implement defensive measures. Security teams are being advised to strengthen their security postures and monitor their systems closely for unusual activity. Fortinet has not yet released a patch in connection with these attacks, but experts are urging immediate action to mitigate potential risks. 'Often, such scans aim at enumerating exposed endpoints, evaluating their significance, and estimating their exploitation potential,' noted one researcher, highlighting the need for vigilance among organizations using Fortinet products.
Organizations are encouraged to review their configurations, apply best practices for network security, and prepare for potential updates from Fortinet as the situation develops. Security professionals are advised to stay informed about emerging threats and take proactive steps to safeguard their networks against possible exploitation.
