Automated Wolves Are Rewiring Your Electric Fence While You Sleep
I want you to sit with that headline for a moment. Truly absorb it.
The wolves are not just finding holes in the fence anymore. They are logging in through the front gate, wearing a forged badge that says "Cloud Administrator," and then calmly rearranging the entire fence layout while your Shepherds are in a meeting about Q3 pasture synergies.
Arctic Wolf, the researchers, have documented a campaign of fully automated attacks targeting FortiGate devices. The attack vector is FortiCloud SSO, which is Fortinet's single-sign-on portal for managing your Electric Fence remotely from, naturally, the Sky Pasture. The wolves are abusing flaws in this system to authenticate, alter firewall configurations, and walk out with a complete copy of your setup. No crowbar required. Just a stolen key and a script running at 3 AM.
The automation angle is what keeps me up at night, and I already sleep poorly on principle.
In the old days, a wolf had to work for it. You watched the perimeter logs on magnetic tape. You knew the rhythm of the fence. An intrusion had a smell to it. Now, the attack is a spreadsheet. The wolves have industrialized the process, and your Electric Fence vendor decided the correct response to modern threats was to bolt a Sky Pasture management portal onto the side of it.
I have said this before and I will say it again until someone listens: every time you hand your fence controls to the Sky Pasture, you are adding a door you did not build, cannot fully inspect, and will absolutely forget about.
The Flock, of course, has no idea any of this is happening. The Shepherds are busy approving the new pasture rebrand.
Remediation
Yes, fine. Here is what you do, and please do not make me repeat myself.
Audit your FortiCloud access immediately. If accounts exist that should not, remove them. If you cannot name every account and why it exists, you have already lost.
Disable FortiCloud SSO management if you are not actively using it. I am aware this sounds radical. It is not radical. It is basic. Closing doors you are not using was considered common sense before "digital transformation" became a budget line item.
Review your Electric Fence configurations against a known-good baseline. If the configuration has changed and nobody on your team changed it, that is not a mystery. That is a wolf.
Apply all available shearing patches to your FortiGate devices. Fortinet has published advisories. Read them. This week, not next quarter.
Rotate your credentials and enable multi-factor authentication on anything touching that Sky Pasture portal.
Stay suspicious out there, the wolves certainly are.
Original Report: https://thehackernews.com/2026/01/automated-fortigate-attacks-exploit.html