2026-11-13NOTABLEexploitedGroup-IB: DarkLunnen's FortiOS chain leaves a 'service' super_admin; Swiss FortiGates are scan targets only
DarkLunnen
actor · actor:darklunnen single-source
Operator tracked by Group-IB whose exposed directory (Group-IB, 2026-11-11) shows mass exploitation of FortiOS CVE-2024-55591 that plants a 'service' super_admin account, a 4,725-target Swiss FortiGate scan list and recorded restic access to an S3 backup repository at a 'Swiss domain'; Group-IB says the lists do not confirm vulnerability or successful exploitation.
Coverage
1
first 2026-11-13 → last 2026-11-13
Latest activity
2026-11-13
Group-IB: DarkLunnen's FortiOS chain leaves a 'service' super_admin; Swiss FortiGates are scan targets only
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector · regions: europe, switzerland
Sources cited
2
2 hosts
Action items (1)
Do-now tasks recorded on the entries about DarkLunnen, newest first. Check the date before acting on an older one.
- On every FortiGate on FortiOS 7.0 below 7.0.17 (and FortiProxy 7.2 below 7.2.13 or 7.0 below 7.0.20) take the HTTP/HTTPS administrative interface off internet-facing interfaces, and on any unit whose interface was ever reachable list the administrators for an account named service or any unexplained super_admin account and review jsconsole logins; where one is found rotate every secret stored in the configuration, because a patch does not remove an account that already exists.2026-11-13Group-IB: DarkLunnen's FortiOS chain leaves a…
Defender insights
What each entry about DarkLunnen tells a defender to do, newest first.
Exposure · detection
Story timeline
Hunting pivots
Affected products
ATT&CK techniques (7 across 5 tactics)
7 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)
- ReconnaissanceActive Scanning: Scanning IP Blocks · Active Scanning: Vulnerability Scanning
- Initial AccessValid Accounts · External Remote Services · Exploit Public-Facing Application
- PersistenceValid Accounts · External Remote Services · Create Account: Local Account · Server Software Component: Web Shell
- Privilege EscalationValid Accounts
- StealthValid Accounts
Reconnaissance TA0043
T1595.001Active Scanning: Scanning IP Blocks×1
Adversaries may scan victim IP blocks to gather information that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses.
Evidence: 2026-11-13/darklunnen-group-ib-fortios-super-admin-swiss-scan-list · ATT&CK page ↗
T1595.002Active Scanning: Vulnerability Scanning×1
Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use.
Evidence: 2026-11-13/darklunnen-group-ib-fortios-super-admin-swiss-scan-list · ATT&CK page ↗
Initial Access TA0001
T1078Valid Accounts×1
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Evidence: 2026-11-13/darklunnen-group-ib-fortios-super-admin-swiss-scan-list · ATT&CK page ↗
T1133External Remote Services×1
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
Evidence: 2026-11-13/darklunnen-group-ib-fortios-super-admin-swiss-scan-list · ATT&CK page ↗
T1190Exploit Public-Facing Application×1
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Evidence: 2026-11-13/darklunnen-group-ib-fortios-super-admin-swiss-scan-list · ATT&CK page ↗
Persistence TA0003
T1078Valid Accounts×1
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Evidence: 2026-11-13/darklunnen-group-ib-fortios-super-admin-swiss-scan-list · ATT&CK page ↗
T1133External Remote Services×1
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
Evidence: 2026-11-13/darklunnen-group-ib-fortios-super-admin-swiss-scan-list · ATT&CK page ↗
T1136.001Create Account: Local Account×1
Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
Evidence: 2026-11-13/darklunnen-group-ib-fortios-super-admin-swiss-scan-list · ATT&CK page ↗
T1505.003Server Software Component: Web Shell×1
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.
Evidence: 2026-11-13/darklunnen-group-ib-fortios-super-admin-swiss-scan-list · ATT&CK page ↗
Privilege Escalation TA0004
T1078Valid Accounts×1
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Evidence: 2026-11-13/darklunnen-group-ib-fortios-super-admin-swiss-scan-list · ATT&CK page ↗
Stealth TA0005
T1078Valid Accounts×1
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Evidence: 2026-11-13/darklunnen-group-ib-fortios-super-admin-swiss-scan-list · ATT&CK page ↗
Entries about DarkLunnen (1)
Co-occurring entities
Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.
Where this entity is cited
Source distribution
- fortiguard.fortinet.com1 (50%)
- group-ib.com1 (50%)