On June 13, 2026, a major cyber campaign was uncovered, compromising nearly 73,932 FortiGate firewalls across 194 countries. According to the campaign description, it impacted many Fortinet devices on the Internet and exposed systems belonging to companies, energy-sector organisations and even a NATO defence contractor.

The attackers did not have to use a new and complex weakness. They used common vulnerabilities, such as internet-accessible management interfaces and leaked or weak credentials. An attacker would then gain access to authentication information, be able to alter firewall settings, establish backdoor accounts and possibly gain further access to internal networks. The investigation, subsequently, reportedly uncovered that the campaign had been targeting 430,000 FortiGate devices and gaining access to 110 million credentials since at least February 2026.

The incident especially got attention in Pakistan when the National Computer Emergency Response Team (National CERT) issued a high-level cybersecurity warning in July. The government urged critical infrastructure firms, such as government departments, banks, telecom and energy companies, to assume their internet-connected FortiGate devices are compromised. This list of recommendations also contained removing management interfaces from public view, bringing systems up to date, resetting credentials, and using multi-factor authentication and monitoring networks to look for intrusion.

But it’s more than a weak firewall that this episode is about. It reveals a deeper issue that is present in Pakistan’s cybersecurity landscape: the disconnect between having security technology and securing it.

Firewalls and VPN gateways are essential in today’s digitalised world to safeguard digital........

© Paradigm Shift