FBI Alerts Active FortiBleed Campaign Harvesting 86,644 Fortinet Device Credentials
What Happened – The FBI and U.S. Secret Service warned that the FortiBleed campaign continues to harvest credentials from internet‑facing Fortinet FortiGate firewalls and SSL VPN gateways. The operation exploits reused or leaked passwords and legacy SHA‑256 password storage, with over 86,000 device credentials already collected.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential hygiene on critical network infrastructure – a core scenario that continuous access‑control monitoring is designed to detect and remediate.
- Highlights the need for auditable evidence of password policies, MFA enforcement, and privileged‑access review to satisfy control‑objective requirements across multiple frameworks.
Who Is Affected – Enterprises across all sectors that deploy FortiGate firewalls or SSL VPNs, especially those relying on legacy password hashing.
Recommended Actions
- Immediately rotate all FortiGate and VPN passwords; enforce strong, unique passwords and enable MFA where possible.
- Disable legacy SHA‑256 password storage and migrate to modern, salted hashing algorithms.
- Deploy continuous credential‑monitoring and log‑analysis to detect anomalous logins.
- Conduct a credential‑risk assessment and document remediation steps for audit readiness.
Source: The Hacker News
Technical Notes – The campaign leverages credential reuse and leaked passwords; no specific CVE is cited. Attack surface includes any internet‑exposed FortiGate firewall or SSL VPN gateway still using the outdated SHA‑256 hash. Source: same as above