Unit 42: attackers used mod_md on FortiGate to spawn reverse shell

Unit 42's 14 October 2026 report describes the CL-STA-0954 intrusion, in which attackers abused the native Apache mod_md module on FortiGate firewalls to spawn an SSH-based reverse shell. ZoomEye counted 2,073,025 assets with the FortiGate title and 47,893 on port 10443.

• Apache mod_md for ACME certificates on FortiGate became a command execution path
• ZoomEye: 2,073,025 FortiGate assets, 47,893 answering on port 10443
• The technique requires an existing foothold to write config or invoke scripts
• Recommended: trusted-host policy, module inventory, egress restrictions