FortiOS Bypass to Hunters International Ransomware

Operators consistent with the Hunters International ransomware group abuse a FortiOS super-admin authentication bypass on an internet-facing FortiGate, plant rogue accounts, pivot over the SSL-VPN tunnel by RDP, sweep the network with Advanced IP and Port Scanner, and push roughly 6.8 GB of share data to a single external host over SFTP before running the encrypter. Work the FortiGate edge, the directory records, the perimeter egress, and the endpoint process tree to reconstruct the intrusion from entry to encryption.