The Evolution of Qilin: From Agenda to Active Fortinet Exploits
The Qilin ransomware operation didn't get to where it is by standing still. Over the past few years, the group—also tracked in threat intelligence circles as Phantom Mantis—has steadily evolved its Tactics, Techniques, and Procedures (TTPs) since first emerging in August 2022 as an Agenda-branded Ransomware-as-a-Service (RaaS) platform. Today, its dark web leak site boasts over 310 victims, spanning major global industries and high-profile targets.
The syndicate's past attacks leave little doubt about its operational reach. Past victims include automotive giant Yangfeng, publishing giant Lee Enterprises, Australia's Court Services Victoria, and pathology services provider Synnovis. The Synnovis incident alone sent shockwaves through the UK healthcare sector, severely impacting several major National Health Service (NHS) hospitals in London and forcing clinicians to cancel hundreds of vital appointments and surgical procedures.
Now, intelligence from PRODAFT reveals that Qilin has added critical Fortinet vulnerabilities to its active deployment arsenal. Spotting partially automated intrusion campaigns between May and June 2025, researchers noted that the threat actors have concentrated initial efforts on Spanish-speaking regions while laying the groundwork for a broader global expansion. For enterprise IT leaders and perimeter defenders, this shift underscores a relentless push toward exploiting edge network appliances for initial access.
Unpacking the Fortinet Vulnerabilities in the Crosshairs
At the center of Qilin's latest campaign are two high-severity flaws that grant attackers unauthorized entry and remote code execution capabilities on vulnerable firewall appliances. PRODAFT's private flash alert links the intrusion wave specifically to CVE-2024-21762 and CVE-2024-55591, highlighting how threat actors leverage automated tooling to sweep through unpatched enterprise perimeters—the same dynamics seen in the credential harvesting campaign that compromised tens of thousands of Fortinet devices.
The first vulnerability, CVE-2024-55591, is hardly a newcomer to the threat landscape. It was previously weaponized as a zero-day by other intrusion syndicates to breach FortiGate firewalls as far back as November 2024. Other criminal outfits, such as the Mora_001 ransomware operator, have leaned on this exact flaw to deploy the SuperBlack ransomware strain—itself tied to the notorious LockBit ecosystem by Forescout researchers.
The second entry, CVE-2024-21762, is an out-of-bounds write flaw affecting FortiOS and FortiProxy. Disclosed and patched earlier in the year, it prompted CISA to issue an emergency directive ordering federal agencies to secure their devices. Despite these warnings, subsequent telemetry from the Shadowserver Foundation revealed that nearly 150,000 devices remained exposed on the public internet weeks after patches became available. This persistent visibility gap is precisely why security teams and threat detection platforms are racing to inventory perimeter assets before automated threat actors can establish a foothold.
Broader Context of Edge Device Exploitation
Qilin's adoption of Fortinet exploits fits into a broader, well-documented playbook across the cybercrime underground. Network edge devices—firewalls, VPN gateways, and load balancers—remain prime real estate for both state-sponsored espionage units and financially motivated extortion gangs. Because these appliances sit directly at the perimeter and often run with elevated privileges, compromising them bypasses traditional endpoint detection and response (EDR) agents installed on internal workstations.
Consider how other advanced threat groups operate. Earlier in the year, Fortinet disclosed that the Chinese state-sponsored group Volt Typhoon abused legacy FortiOS SSL VPN flaws—specifically CVE-2022-42475 and CVE-2023-27997—to install the custom Coathanger remote access Trojan (RAT). That backdoor was subsequently used to compromise military networks belonging to the Dutch Ministry of Defence, demonstrating the severe national security implications of unpatched edge infrastructure. Fortinet products have faced pressure on other fronts as well, including unauthenticated remote code execution in FortiSandbox under active exploitation.
Nor is Fortinet the only vendor in the crosshairs. CISA's advisory catalogs are replete with emergency warnings targeting edge technologies across the enterprise stack. Recent months have seen similar exploitation waves targeting TeamCity continuous integration servers, VMware virtualization gateways, WatchGuard firewalls, Microsoft SharePoint instances, and Citrix application delivery controllers, alongside edge management platforms. Whenever a critical perimeter flaw drops, ransomware operators waste no time integrating it into their automated scanning and exploitation frameworks.
Actionable Defense Strategies for Perimeter Security
Defending against an agile, financially motivated syndicate like Qilin requires more than crossing fingers and hoping patches apply themselves. Enterprise security engineers must treat perimeter asset management as an ongoing, high-priority operational discipline rather than an occasional housekeeping chore.
First, organizations must ensure that all FortiOS, FortiProxy, and related edge devices are updated immediately against CVE-2024-21762 and CVE-2024-55591, adhering strictly to vendor advisories and CISA remediation timelines. Beyond patching, network administrators need to implement rigorous segmentation, restricting administrative access to internal management interfaces and disabling SSL VPN features where they are no longer business-critical.
Finally, threat monitoring must extend beyond internal endpoints to encompass gateway logs, authentication traffic anomalies, and unexpected outbound connections. When ransomware gangs weaponize perimeter appliances, early detection depends entirely on catching anomalous behavior at the firewall boundary before lateral movement can take root.
