17,000+ Fortinet devices worldwide have been compromised in a sophisticated cyberattack that leverages a symbolic link persistence technique, according to new findings from Shadowserver.

The number of affected devices has climbed from an initial report of 14,000 to 17,000, with the figure expected to rise as investigations continue.

The attack exploits previously known vulnerabilities in Fortinet’s FortiGate devices, including several critical flaws that have been publicly documented in recent years.

After gaining initial access, the threat actors implemented a symbolic link (symlink) connecting the user filesystem to the root filesystem in a folder used to serve language files for the SSL-VPN feature.

This symlink allowed attackers to maintain read-only access to sensitive files and configurations on compromised devices. The modification was made in the user filesystem, which is not typically overwritten during standard firmware updates.

The graph illustrates the rapid surge in compromised Fortinet devices across different regions between April 11 and April 16, 2025.

Asia is the most heavily impacted, accounting for roughly half of the total cases, followed by Europe and North America, which together represent a significant portion of the affected devices. South America, Africa, and Oceania show much smaller numbers in comparison.

The total number of impacted devices surpasses 17,009, with the majority of the increase occurring within just a few days, highlighting both the global scale and the sudden escalation of this symbolic link attack.

As a result, even after organizations patched their devices to address the original vulnerabilities, the malicious symlink could remain, providing attackers with persistent access.

Security authorities warn that the attackers’ access could include sensitive configuration files, credentials, and cryptographic keys. In some cases, the compromise may have begun as early as 2023, suggesting that the campaign has operated undetected for a significant period.

Fortinet’s Response and Recommendations

Fortinet has responded by directly notifying affected customers and releasing updates for multiple versions of FortiOS.

These updates are designed to detect and remove the malicious symlinks and prevent similar persistence techniques in the future. The company urges all customers to upgrade to the latest FortiOS versions, including 7.6.2, 7.4.7, 7.2.11, 7.0.17, or 6.4.16.

However, cybersecurity agencies emphasize that patching alone may not be sufficient. Organizations are strongly advised to:

Isolate compromised devices from their networks
Conduct a thorough forensic investigation to determine the extent of the breach
Reset all authentication credentials and secrets that may have been exposed

Devices that have never enabled SSL-VPN functionality are not believed to be affected by this specific attack vector.

This incident underscores a troubling trend in cyberattacks: threat actors are not only rapidly exploiting known vulnerabilities but are also embedding persistence mechanisms that can survive standard remediation efforts.

The ability to maintain access even after patches are applied poses a significant long-term risk, particularly for organizations managing critical infrastructure.

As investigations continue, security experts urge organizations to remain vigilant, ensure all devices are fully patched, and review system configurations for any signs of unauthorized changes or lingering persistence mechanisms.

Malware Trends Report Based on 15000 SOC Teams Incidents, Q1 2025 out!-> Get Your Free Copy

The post 17,000+ Fortinet Devices Compromised in Massive Hack via Symbolic Link Exploit appeared first on Cyber Security News.