Fortinet FortiOS

Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.

Evidence: 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase.

Evidence: 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-10-16/peerstitch-fortigate-implant-cve-2025-61624-fortimanager · 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-10-16/peerstitch-fortigate-implant-cve-2025-61624-fortimanager · 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-16/peerstitch-fortigate-implant-cve-2025-61624-fortimanager · 2026-09-10/cve-2025-25249-fortinet-fortios-capwap-pivotc2-rat · 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · 2026-07-28/cve-2025-68686-fortios-ssl-vpn-symlink-persistence-kev · ATT&CK page ↗

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems. WMI is an administration feature that provides a uniform environment to access Windows system components.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. PowerShell can also be installed on Linux and macOS. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

Evidence: 2026-09-10/cve-2025-25249-fortinet-fortios-capwap-pivotc2-rat · 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · ATT&CK page ↗

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.

Evidence: 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Evidence: 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · ATT&CK page ↗

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.

Evidence: 2026-10-16/peerstitch-fortigate-implant-cve-2025-61624-fortimanager · ATT&CK page ↗

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-10-16/peerstitch-fortigate-implant-cve-2025-61624-fortimanager · 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-10-16/peerstitch-fortigate-implant-cve-2025-61624-fortimanager · 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

Evidence: 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Evidence: 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · ATT&CK page ↗

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process.

Evidence: 2026-09-10/cve-2025-25249-fortinet-fortios-capwap-pivotc2-rat · ATT&CK page ↗

Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.

Evidence: 2026-10-16/peerstitch-fortigate-implant-cve-2025-61624-fortimanager · ATT&CK page ↗

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-10-16/peerstitch-fortigate-implant-cve-2025-61624-fortimanager · ATT&CK page ↗

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-10-16/peerstitch-fortigate-implant-cve-2025-61624-fortimanager · 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-09-10/cve-2025-25249-fortinet-fortios-capwap-pivotc2-rat · ATT&CK page ↗

Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process.

Evidence: 2026-09-10/cve-2025-25249-fortinet-fortios-capwap-pivotc2-rat · ATT&CK page ↗

Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.

Evidence: 2026-10-16/peerstitch-fortigate-implant-cve-2025-61624-fortimanager · ATT&CK page ↗

Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior.

Evidence: 2026-10-16/peerstitch-fortigate-implant-cve-2025-61624-fortimanager · ATT&CK page ↗

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-10-16/peerstitch-fortigate-implant-cve-2025-61624-fortimanager · 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components.

Evidence: 2026-07-28/cve-2025-68686-fortios-ssl-vpn-symlink-persistence-kev · ATT&CK page ↗

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mechanisms to obscure malicious activity, blend in with benign activity, and avoid scrutiny. Adversaries can perform this behavior within virtualization/sandbox environments or natively on host systems.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may intentionally exclude certain files, folders, directories, file types, or system components from encryption or tampering during a ransomware or malicious payload execution. Some file extensions that adversaries may avoid encrypting include `.dll`, `.exe`, and `.lnk`.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as:

Evidence: 2026-10-16/peerstitch-fortigate-implant-cve-2025-61624-fortimanager · ATT&CK page ↗

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. Credentials can then be used to perform Lateral Movement and access restricted information.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Evidence: 2026-10-16/peerstitch-fortigate-implant-cve-2025-61624-fortimanager · 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. OS Credential Dumping can be used to obtain password hashes, this may only get an adversary so far when Pass the Hash is not an option. Further, adversaries may leverage Data from Configuration Repository in order to obtain hashed credentials for network devices.

Evidence: 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.

Evidence: 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts.

Evidence: 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Evidence: 2026-10-16/peerstitch-fortigate-implant-cve-2025-61624-fortimanager · 2026-09-10/cve-2025-25249-fortinet-fortios-capwap-pivotc2-rat · ATT&CK page ↗

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Evidence: 2026-10-16/peerstitch-fortigate-implant-cve-2025-61624-fortimanager · 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.

Evidence: 2026-09-10/cve-2025-25249-fortinet-fortios-capwap-pivotc2-rat · ATT&CK page ↗

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.

Evidence: 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · ATT&CK page ↗

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts).

Evidence: 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Evidence: 2026-09-10/cve-2025-25249-fortinet-fortios-capwap-pivotc2-rat · 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Evidence: 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · 2026-07-28/cve-2025-68686-fortios-ssl-vpn-symlink-persistence-kev · ATT&CK page ↗

Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses. Adversaries can collect or forward email from mail servers or clients.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may access data from cloud storage.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-09-10/cve-2025-25249-fortinet-fortios-capwap-pivotc2-rat · 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · ATT&CK page ↗

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

Evidence: 2026-09-10/cve-2025-25249-fortinet-fortios-capwap-pivotc2-rat · ATT&CK page ↗

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

Evidence: 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Evidence: 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.

Evidence: 2026-09-10/cve-2025-25249-fortinet-fortios-capwap-pivotc2-rat · ATT&CK page ↗

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts. Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious changes into place.

Evidence: 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, "pig butchering," bank hacking, and exploiting cryptocurrency networks.

Evidence: 2026-08-11/gunra-raas-fortios-mfa-backdoor-linux-prng-recoverable · ATT&CK page ↗