For engineersS=1:5
Evidence before the reboot
Much of a VPN appliance's evidence is lost on reboot, upgrade or reset. Only 25 of 102 Japanese victims kept all logs. Both hospital reports lost VPN logs.
Summary
Which accounts logged in, from where, and what changed on the box: the appliance’s logs answer these first questions, and many appliances keep them only on local storage of limited size. In two Japanese hospital cases, the vendor upgraded the firmware after the attack without saving the logs, and the investigators could not establish how the intruder got in.
Technical detail
Three kinds of log, mostly kept on the box
Names differ by product, but SSL-VPN appliances generally write these three kinds of record.
| Log | What it records | What it answers |
|---|---|---|
| Authentication and VPN session | User, source address, assigned tunnel address, start and end time, bytes moved | Which accounts were used, from where, during the exposure window |
| Administration and configuration | Administrator logins, configuration changes, configuration exports, new accounts | Whether someone took the configuration or added a way back in. JPCERT/CC tells FortiGate owners to review configuration export history and look for unintended administrator accounts (JPCERT-AT-2026-0019). |
| System and crash | Daemon crashes, reboots, upgrades, hardware events | Whether a memory-corruption exploit was tried: a failed or successful attempt can crash the daemon that handles the request |
Logdesc=Application crashed and msg=[...] application:sslvpnd,[...], Signal 11 received, Backtrace: [...]Logdesc=Application crashed: a process stopped unexpectedly.application:sslvpnd: the SSL-VPN daemon, which handles pre-auth requests.Signal 11: a segmentation fault. A failed heap-overflow attempt such as CVE-2022-42475 tends to produce this.
Source: Fortinet PSIRT Heap-based buffer overflow in sslvpnd (FG-IR-22-398, Indicators of Compromise)
The UK NCSC wrote in 2026 that with network devices defenders “can have fewer tools available to them than the attacker”, and that “manufacturers should provide supported mechanisms for gathering the evidence needed to investigate incidents”.
Source: JPCERT/CC 「Fortinet製品に関連する認証情報の漏えいに関する注意喚起」 (JPCERT-AT-2026-0019)NCSC (UK) Making forensic observability the norm for network devices
Only 25 of 102 victims kept all their logs
Of the causes NPA recorded, deletion by the attacker and encryption are what an intruder does to logs left within reach. An expired retention period is a setting.
Source: National Police Agency 「令和７年におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編P122, P124, P126, P129, P130; sheets 統計編P137, P138)
Data
| Item | NPA label | Count |
|---|---|---|
| All preserved | 全て保全 | 25 |
| Partly unusable | 一部利用不可 | 64 |
| Unusable | 利用不可 | 8 |
| No logs collected | ログ取得無 | 5 |
| Cause: deleted by the attacker | 犯人による削除 | 20 |
| Cause: encrypted | 暗号化 | 20 |
| Cause: retention period expired | 保存期間経過 | 18 |
| Cause: deleted by mistake | 誤削除 | 3 |
| Cause: other | その他 | 7 |
These are all ransomware victims who answered, not only those entered through a VPN, and the logs include servers and PCs as well as appliances.
The hospitals lost the VPN logs to the fix
なお、C 社が 10 月 31 日の夕方にファイアウォール Z のファームウェアを、バックアップを取らずにバージョンアップしたため VPN 機器の Syslog が消失した。そのため、10 月 31 日の攻撃が単独で行われたか否かを断定することはできなかった。
Osaka General Medical Center report, p.46. Translation: “Company C upgraded the firmware of firewall Z on the evening of October 31 without taking a backup, so the VPN device’s syslog was lost. It was therefore not possible to determine whether the October 31 attack was a single event.”
本侵入経路を証明するために VPN 装置等のログの分析を試みたが、インシデント発生後に A 社によってファームウェアの更新などの作業を、ログ保存などを鑑みずに実施されていたため調査を実施することができなかった。
Handa Hospital report, main volume, printed p.16. Translation: “We tried to analyze the logs of the VPN device and other equipment to prove this route of entry, but could not, because after the incident Company A had updated the firmware and done other work without regard to preserving the logs.”
Source: Osaka General Medical Center, Information Security Incident Investigation Committee 「調査報告書」 (pp.11–12, 18–19, 36–41, 45–47; pp.11, 37, 45–46, 71)Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書」 (printed pp.6–7, 13, 16, 21–22; pp.6–9, 13, 21, 37–38)
At Osaka, the hospital’s firewall logs reached back to April 2022 and showed RDP traffic and failed logons going back months before the October attack (p.39).
A reboot, an upgrade and a reset each erase something
Anything in memory is gone after any of them. Files on the appliance usually survive a reboot; an upgrade may replace or reformat the partition that holds them, which is what happened at both hospitals. A factory reset removes logs and configuration. Files the intruder planted are the exception: the advisories on the patching page describe implants that survived reboots, upgrades and, on Ivanti, a factory reset.
Firmware upgrade: 2 of 7 kinds of evidence are lost, 3 more may be. The intruder's files may survive.
Source: Osaka General Medical Center, Information Security Incident Investigation Committee 「調査報告書」 (pp.11–12, 18–19, 36–41, 45–47; pp.11, 37, 45–46, 71)Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書」 (printed pp.6–7, 13, 16, 21–22; pp.6–9, 13, 21, 37–38)MIVD and AIVD (Netherlands), published by NCSC-NL Ministry of Defence of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT (p.1, p.2 §3.1; p.1 (Wayback Machine capture of the NCSC-NL PDF of 2024-02-06; ncsc.nl no longer serves it))CISA ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devices (Background; Background; V1 update 2026-04-23)CISA and partners Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways (AA24-060B)
Data
| Evidence | Reboot | Firmware upgrade | Factory reset |
|---|---|---|---|
| Running processes, connections | lost | lost | lost |
| Logs held only in memory | lost | lost | lost |
| Local log files | kept | may be lost | lost |
| Crash records | kept | may be lost | lost |
| Configuration as found | kept | may be lost | lost |
| Files the intruder planted | may survive | may survive | may survive |
| Logs already sent to a SIEM | kept | kept | kept |
| Exports taken before acting | kept | kept | kept |
Before the reboot, take copies
In this order, before any patch, reboot or reset. If your incident-response provider is on the way, ask them before you touch the box.
| Step | What | Why |
|---|---|---|
| 1 | Write down the time, the appliance’s clock and its offset from a reliable time source, and who has logged in to it since the alert | To line up the appliance’s timestamps with the SIEM, the domain controllers and the firewall |
| 2 | Export the configuration as it is now | It shows added accounts and changed settings. It also holds secrets, so store it as sensitive. Fortinet: “Treat all configuration as potentially compromised”. Do not restore from it |
| 3 | Export every local log: system and crash, VPN and authentication, administration | What both hospitals lost |
| 4 | Collect the vendor’s supported diagnostic or forensic package, and memory if your provider can | The NCSC specification for device makers lists “Volatile data collection” (memory, process state, network tables, crash dumps). Many devices lack it |
| 5 | Hash the copies and store them off the box, read-only | The copies can be verified later and survive whatever happens to the appliance |
| 6 | Only then patch, reboot or reset | The flowchart continues from here |
Source: Fortinet PSIRT Analysis of Threat Actor ActivityUK National Cyber Security Centre Guidance on digital forensics and protective monitoring specifications for producers of network devices and appliances (Secure logging actions; Volatile data collection)NCSC (UK) Making forensic observability the norm for network devices
Keep logs where the intruder cannot reach them
Copies taken during an incident hold only what the appliance still has. Logs sent off the box every day also cover the weeks before the vulnerability was known.
| Setting | Target | Basis |
|---|---|---|
| Destination | A SIEM or syslog collector off the appliance, receiving in near real time | CCCS: “Enable centralized (off-device) logging and configure log levels to be as detailed as possible”. The NCSC specification recommends “appropriate remote logging solutions where feasible.” |
| Detail | Authentication, session, administration, configuration and crash events, at the most detailed level the appliance supports | Same CCCS line |
| Retention | Longer than a zero-day stays undisclosed, in months | CitrixBleed: exploited from late August 2023, disclosed 2023-10-10. CVE-2025-0282: exploited from mid-December 2024, disclosed 2025-01-08. NPA: 18 answers lost logs to an expired retention period |
| Time | NTP on the appliance, the collector and every server, with the same sources | NCSC: “All systems should run the network time protocol (NTP) from reputable and redundant sources.” |
| Alerts | Successful administrator logins, configuration changes, hardware changes | CCCS: “Alert on successful administrative log-ons, configuration changes and hardware changes” |
Source: Canadian Centre for Cyber Security Security considerations for edge devices (ITSM.80.101) (ITSM.80.101)UK National Cyber Security Centre Guidance on digital forensics and protective monitoring specifications for producers of network devices and appliances (Secure logging actions; Volatile data collection)Mandiant (Google Cloud) Investigation of Session Hijacking via Citrix NetScaler ADC and Gateway Vulnerability (CVE-2023-4966)Google Cloud (Mandiant) Ivanti Connect Secure VPN Targeted in New Zero-Day ExploitationNational Police Agency 「令和７年におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編P122, P124, P126, P129, P130; sheets 統計編P137, P138)