UNC5820 Exploits Critical FortiManager Zero-Day to Hijack Enterprise Networks

Fortinet has identified a zero-day vulnerability in the FortiManager API, tracked as CVE-2024-47575, which has been actively exploited in attacks. This flaw has resulted in the mass exploitation of over 50 potentially compromised FortiManager devices across various industries. Attackers have leveraged this vulnerability to steal sensitive files, including device configurations, IP addresses, and credentials. A new threat actor group, UNC5820, has been exploiting this vulnerability to stage and exfiltrate configuration data from FortiGate devices managed through the compromised FortiManager platform.