FortiBleed Campaign Continues to Harvest FortiGate Credentials and Lock Out Administrators
What Happened — Threat actors are still scanning for exposed Fortinet FortiGate firewalls and VPN endpoints, using credentials harvested earlier in the FortiBleed campaign to gain administrative access and, in many cases, lock legitimate users out. The FBI and Secret Service warned that the activity has become a preferred entry point for ransomware affiliates.
Why It Matters for Trust & Control Assurance
- Continuous credential‑management monitoring is needed to detect the reuse of stolen passwords before they are leveraged for lateral movement.
- Enforcing multifactor authentication (MFA) on privileged and VPN accounts provides a defensible control that can stop the attack chain at the credential‑use stage.
- Evidence of rapid isolation of compromised hosts and termination of active sessions is essential for an audit‑ready incident‑response program.
Who Is Affected
- Enterprises that deploy FortiGate firewalls or SSL‑VPNs (across finance, healthcare, retail, cloud services, etc.).
Recommended Actions
- Verify that MFA is enabled for all privileged, admin, and VPN accounts.
- Conduct an immediate inventory of exposed FortiGate devices and rotate any credentials discovered in public leaks.
- Deploy continuous monitoring for anomalous admin logins and automate session termination for compromised sessions.
Source: DataBreachToday
Technical Notes
- Attack vector: stolen/harvested credentials used to access FortiGate management interfaces and SSL‑VPN portals.
- Actors rent GPU infrastructure to crack large volumes of password hashes, then scan the Internet for vulnerable firewalls.
- No new zero‑day vulnerability disclosed; the campaign relies on previously leaked credentials.
Source: DataBreachToday