FortiGate Exploitation Campaign: How Stolen Service Accounts Enable Rogue Workstation Deployment and Full AD Compromise

Active exploitation of three FortiGate CVEs lets attackers extract LDAP credentials, join rogue workstations to Active Directory, and exfiltrate NTDS.dit files.