DarkLunnen: Group-IB's exposed operator directory shows mass exploitation of FortiOS CVE-2024-55591 that plants a 'service' super_admin account, a 4,725-target Swiss FortiGate scan list and restic access to an S3 backup repository at a 'Swiss domain'; Group-IB does not confirm any Swiss victim
Group-IB: DarkLunnen's FortiOS chain leaves a 'service' super_admin; Swiss FortiGates are scan targets only
Defender actions
- On every FortiGate on FortiOS 7.0 below 7.0.17 (and FortiProxy 7.2 below 7.2.13 or 7.0 below 7.0.20) take the HTTP/HTTPS administrative interface off internet-facing interfaces, and on any unit whose interface was ever reachable list the administrators for an account named service or any unexplained super_admin account and review jsconsole logins; where one is found rotate every secret stored in the configuration, because a patch does not remove an account that already exists.
Analysis
Group-IB reports that in late July 2026 it found an open directory on a Latvian server that held the operator's /root/ directory, 457 files of which 35 were recovered, and documents more than 14 months of operations against Europe by an operator it tracks as DarkLunnen; Group-IB links it to no known actor and does not establish nationality or state affiliation (Group-IB, 2026-11-11). The main campaign used a modified watchTowr proof of concept for FortiOS CVE-2024-55591, designed to create a backdoor super-admin account named service (Group-IB, 2026-11-11); the recovered results list about 600 devices in Turkey (hospitals, industry and municipalities), 16 in Ukraine, 14 in Azerbaijan and 1 in Algeria, and a stolen FortiGate configuration from a Romanian organisation carried the same account and yielded 10 cleartext VPN passwords (Group-IB, 2026-11-11).
The Swiss content is thin. Group-IB recovered a list of 4,725 FortiGate scanning targets for Switzerland and says such lists identify scanning targets but do not confirm vulnerability or successful exploitation; a table of additional operations also lists restic commands with AWS credentials accessing an S3 repository at a Swiss domain in May and June 2025, with production snapshots enumerated, and the report names no organisation and says that for several operations the evidence is limited to recorded commands (Group-IB, 2026-11-11). Fortinet's advisory FG-IR-24-535 lists FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12 and 7.0.0 through 7.0.19 as affected, fixed in 7.0.17, 7.2.13 and 7.0.20, names FortiOS 7.2, 7.4, 7.6 and 6.4 as not affected and offers disabling the HTTP/HTTPS administrative interface as the workaround (Fortinet PSIRT, 2025-01-14).
Cited evidence
DarkLunnen used a modified proof-of-concept (PoC) exploit developed by watchTowr for FortiGate CVE-2024-55591, designed to create a backdoor super-admin account named “service”.
Additional FortiGate scanning target lists were recovered for Switzerland (4,725 targets), South Korea (5,199), and Ireland (647). These lists identify scanning targets but do not confirm vulnerability or successful exploitation.
For several of these operations, the available evidence is limited to recorded commands. Unless otherwise indicated, the findings do not independently confirm successful exploitation, unauthorized access, or data exfiltration.
Sources2
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.