Initial access came from exploitation of CVE-2024-47575 against a centralised FortiManager appliance; the attackers then exfiltrated an archive containing running configurations, cryptographic material and database files covering more than 500 managed FortiGate firewalls that protected the target's own infrastructure and its clients' networks, and used that intelligence to maintain long-term access, intercept network traffic and establish VPN sessions.