Arctic Wolf reports threat actors abuse trusted endpoint management infrastructure to spread malware across managed endpoints.
- Threat actors exploit patched FortiClient EMS vulnerability to deliver credential-stealing malware
- Attackers disguise malware payload as legitimate Fortinet endpoint software
- Campaign abuses trusted endpoint management infrastructure to spread across managed endpoints
Threat actors are exploiting a critical vulnerability in FortiClient Endpoint Management Server (EMS) to deploy credential-stealing malware across enterprise networks, according to Arctic Wolf researchers.
The attack campaign leverages a now-patched security flaw in FortiClient EMS deployments to distribute malicious payloads across managed endpoints. Arctic Wolf reports that attackers are disguising the credential stealer as legitimate Fortinet endpoint software.
“The campaign abused trusted endpoint management infrastructure to deliver malware across managed endpoints,” Arctic Wolf stated.
FortiClient EMS is Fortinet’s centralised management platform for deploying, configuring and monitoring FortiClient endpoint protection software across enterprise networks. The platform’s trusted position in enterprise infrastructure makes it an attractive target for attackers seeking to distribute malware at scale.
By compromising the management server, threat actors can potentially push malicious updates or configurations to all connected endpoints, effectively turning the security infrastructure against itself.
The vulnerability has been patched by Fortinet, though the research indicates active exploitation continues against unpatched systems. The credential-stealing payload allows attackers to harvest login credentials and other sensitive authentication data from compromised endpoints.
Why It Matters
This incident highlights the critical risk posed when endpoint management platforms are compromised. CISOs should recognise that centralised management tools, while essential for security operations, represent high-value targets that can enable enterprise-wide compromise through a single point of failure.
The disguising of malware as legitimate vendor software complicates detection and may bypass security controls that trust signed or vendor-distributed content. This attack pattern requires CISOs to review trust assumptions in their security architecture.
What To Do Now
- Verify FortiClient EMS systems are updated with the latest patches from Fortinet security advisories
- Review logs for unusual FortiClient EMS activity or unexpected endpoint software deployments
- Audit trust relationships and signing verification for endpoint management platforms
