FortiBleed Credential‑Harvesting Campaign Compromises 86,644 Fortinet FortiGate Firewalls Worldwide
What Happened — A coordinated campaign dubbed FortiBleed used publicly‑leaked and weakly‑hashed Fortinet credentials to log into, lock out administrators, and create new privileged accounts on 86,644 FortiGate firewalls in 194 countries. The attackers first scanned for exposed SSL‑VPN portals, then performed credential‑stuffing and GPU‑accelerated hash cracking to obtain clear‑text passwords.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of reused or weakly‑protected privileged credentials on critical infrastructure – a control‑objective that continuous‑monitoring programs are built to detect and evidence.
- Highlights the need for real‑time privileged‑access review, automated credential‑rotation, and immutable audit logs to prove due‑diligence during an audit.
- Shows that a single compromised admin account can cascade into network‑wide lateral movement, underscoring the importance of a robust identity‑and‑access‑control (IAM) assurance capability.
Who Is Affected – Any organization that deploys FortiGate firewalls, spanning technology, financial services, healthcare, manufacturing, and government sectors.
Recommended Actions
- Immediately rotate all admin passwords on FortiGate devices and enforce MFA for privileged accounts.
- Deploy continuous credential‑usage monitoring and alert on anomalous login patterns.
- Validate that privileged‑access logs are being collected, immutable, and retained for audit purposes.
- Review and harden SSL‑VPN exposure (disable unnecessary portals, enforce strong cipher suites).
Source: Security Affairs – FortiBleed hit 86,000 firewalls
Technical Notes – The attack chain relies on credential‑stuffing, password‑spraying, and GPU‑accelerated hash cracking (Hashcat + Hashtopolis). No new zero‑day vulnerability is exploited; the weakness is the continued use of leaked or weakly‑hashed admin credentials.