Unit 42: FortiGate attacks hide traces by silencing logs

Unit 42 described cluster CL-STA-0954, which on Fortinet edge devices stops syslog generation, clears crash logs, disrupts telemetry and deletes rogue admin accounts and auto-script objects after execution. Defenders are advised to alert on missing events and independent reachability checks rather than on malicious objects alone.

• Attack disables syslog, clears crash logs and disrupts telemetry
• Rogue admin accounts and auto-script objects are deleted after execution
• ZoomEye counted 2.68M FortiGate SSL VPN assets on October 22
• Detection relies on log-volume drops and external reachability checks