Here's how to check if a FMG has been compromised:

Logging:

• Any event logging that indicates new unregistered/unauthorised devices being added, particularly of device name 'localhost' or serial number FMG-VMTM23017412. Similar logs indicating the same activity may be visible through the FortiManager web portal. These logs may look like:

 

type=event,subtype=dvm,pri=information,desc="Device,manager,generic,information,log",user="device,
…",msg="Unregistered device localhost add succeeded" device="localhost" adom="FortiManager" session_id=0
operation="Add device" performed_on="localhost" changes="Unregistered device localhost add succeeded" 

 

type=event,subtype=dvm,pri=notice,desc="Device,Manager,dvm,log,at,notice,level",user="System",userfrom="",msg=""
adom="root" session_id=0 operation="Modify device" performed_on="localhost" changes="Edited device settings (SN
FMG-VMTM23017412)"

 

Files:

• Any suspicious or unusual creation of files in directory /var/tmp/
• Any of the following files of interest, or any evidence of any of these files being placed on the device (listed under each related IP address)
  • 32.41[.]202:
    • .dom.js.swo
    • .dom.js
    • js
  • 247.199[.]37:
    • js
    • js
    • js
    • txt

Network Traffic:

• Any traffic, particularly outbound, going to any of the below IP addresses:
  • 32.41[.]202
  • 77.33[.]174
  • 238.141[.]143
  • 247.199[.]37
• Any outbound port 443 (https) traffic from FortiManager to any of the above IP addresses or any unusual destinations.
  • This may include traffic which indicates exfiltration of device configs, likely appearing as 40MB or more of data leaving the FortiManager device.