Lessons from FortiNet and Palo Alto Networks: Firewalls Fall and Ghosts Attack

Perimeter and endpoint defenses are failing. Two major security events on July 5-6  reveal how attackers breach critical infrastructure and remain invisible to standard security tools.

‍

Fortinet’s FortiBleed (Disclosed July 6)

‍

A massive credential leak exposed over 86,000 firewall administrator accounts. These accounts were compromised through GPU-cracked legacy hashes, affecting more than 250 organizations. 

‍

The primary risk is that compromised firewalls allow attackers to easily pivot from IT networks into high-security OT zones.

‍

Palo Alto’s TinyRCT (Disclosed July 5)

‍

A new nation-state backdoor called TinyRCT specifically targets utilities. This malware is uniquely dangerous because it is designed to self-destruct upon detection, erasing all local evidence of its existence.

‍

 This makes traditional forensics useless, as there is no "smoking gun" left on the infected endpoint for investigators to find.

‍

The Full Attack Chain

‍

The combination of these two threats creates a devastating blueprint for attacking critical infrastructure:

‍

• Break-In: Attackers use stolen admin credentials from the FortiBleed leak to walk through the front door of the network.

• Hide & Persist: Once inside, they deploy TinyRCT to maintain access. If nearly caught, the malware erases itself, leaving the security team with no idea how the breach happened or what was stolen.

‍

Why Traditional Security Fails

‍

Legacy security tools often have a "binary blind spot," focusing only on whether a device is up or down. These tools are frequently tuned for IT environments and fail to see the unknown or explain root-cause behaviors in OT or power-related systems. 

‍

Furthermore, traditional firewalls are designed to trust administrator access; if an attacker has stolen valid credentials, the firewall assumes their malicious activity is legitimate. When the malware self-destructs, endpoint-based tools are left with nothing to scan, creating a permanent gap in the forensic record.

‍

The Komodo Eye Solution: The Wire Never Lies

‍

While attackers delete local logs and hide behind stolen names, they cannot hide their actual behavior on the network. Komodo Eye® provides the internal observability needed to catch these sophisticated threats. Here’s how:

‍

Immutable 5-Year Data Lake: Komodo Eye retains high-resolution telemetry data for 60 months. Even if malware deletes local evidence, the records of its communication and lateral movement are preserved in Komodo’s tamper-resistant, on-premises data lake.

‍

Catching Lateral Movement: Komodo Eye’s continuously compares the live network against official asset databases. It generates alerts for "unmonitored adjacencies"—such as when a router detects a new neighbor pairing—or when an unauthorized MAC address appears on a regulated segment.

‍

Semantic Intelligence: Komodo Eye finds "rare events"—error messages that might appear only a few times a year across millions of devices. This allows engineers to spot the subtle first signs of a security breach that standard filters would ignore as noise.

‍

Layer 0 to Layer 5 Visibility: Because Komodo Eye monitors everything from physical power (Layer 0) to application logic (Layer 5), it correlates network anomalies with physical events, such as a cabinet door being opened or a power supply failing, providing the context traditional tools lack.

‍

Conclusion

‍

In OT environments, internal observability is no longer an optional luxury—it is an essential requirement. 

‍

As threats become more adaptive and self-erasing, organizations must move toward air-gapped, behavioral intelligence that doesn't just watch the door, but monitors every movement inside the house.

‍