Cybersecurity researchers have identified an extensive campaign targeting Fortinet FortiGate firewall devices with public-facing management interfaces. This ongoing campaign represents a serious security risk to organizations relying on these devices for critical network functions. The malicious activity began in mid-November 2024 and involves exploiting a zero-day vulnerability (CVE-2024-55591) to gain unauthorized administrative access, modify configurations, and establish persistent infiltration via SSL VPN connections. Additionally, the legacy vulnerability CVE-2022-40684 has resurfaced, leading to catastrophic data leaks, further amplifying risks.