Despite security updates being installed, cyber criminals have managed to gain permanent access to FortiGate devices. The attackers exploit known vulnerabilities that have long since been closed - but they go one better: they leave behind a so-called backdoor through which they retain access even after the patch.

In January 2025, Arctic Wolf's threat research team observed suspicious activity on Fortinet FortiGate firewall devices being exploited by the new SuperBlack ransomware. This vulnerability could jeopardize companies that have not yet applied the patch and highlights the growing threat of targeted cyberattacks.