DGSSI warns of Fortinet data leak affecting Moroccan entities

The Centre for Monitoring, Detection, and Response to Cyber Attacks maCERT reported that approximately 75,000 devices globally are affected, including several belonging to Moroccan entities. Cyber attackers reportedly obtained administrator credentials and valid VPN access by exploiting configuration files from internet-connected FortiGate devices. This compromised information could be used to infiltrate internal networks, seize control of IT systems, deploy ransomware, or steal confidential data.

In response to this threat, the DGSSI advises affected organizations to verify if their systems are compromised, immediately reset administrator and VPN access passwords, and enable multi-factor authentication MFA. It also recommends updating systems to secure FortiOS versions, restricting internet access to management interfaces, and diligently monitoring connection logs for any suspicious activity. This alert underscores the critical need for businesses and administrations to continuously strengthen their cybersecurity measures against increasingly sophisticated threats that could jeopardize critical infrastructure and sensitive data.