FBI Warns FortiBleed Credential Leak Enables Lockout of FortiGate VPN Administrators
What Happened — The FBI disclosed that attackers are exploiting the “FortiBleed” leak of 73,932 Fortinet firewall URLs and plaintext passwords to gain unauthorized access to FortiGate SSL‑VPN portals. Using stolen or harvested credentials, they create rogue admin accounts, delete or change legitimate admin passwords, and thereby lock out the rightful administrators. The compromised access is also being leveraged as an entry point for ransomware affiliates such as INC/Lynx.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate identity‑and‑access controls on critical network gateways – a core control‑area that continuous‑control‑assurance programs are built to protect and evidence.
- Highlights the need for strong password‑storage practices (e.g., PBKDF2) and multi‑factor authentication, which provide defensible audit evidence of compliance with access‑control objectives.
- Emphasizes the importance of continuous monitoring of admin‑account changes and log review to detect unauthorized privilege escalation.
Who Is Affected – Organizations that expose FortiGate SSL‑VPN gateways to the internet, spanning technology SaaS providers, cloud‑infrastructure operators, and enterprises across multiple sectors.
Recommended Actions –
- Immediately restrict external access to FortiGate VPN portals and terminate all active VPN sessions.
- Enforce MFA for all administrative accounts and adopt PBKDF2 (or stronger) for password hashing.
- Implement continuous monitoring of admin‑account creation, deletion, and password changes; retain logs as audit evidence.
Source: BleepingComputer
Technical Notes – Attackers obtain credentials from the FortiBleed leak, infostealer logs, credential‑stuffing, and password‑spraying. They then use GPU‑accelerated Hashcat clusters to crack hashes offline. The chain includes automated scanning of exposed VPN portals, creation of rogue admin accounts, and lateral movement.
Source: BleepingComputer