FortiBleed Campaign Locks Administrators Out of Internet‑Facing Fortinet Firewalls
What Happened — Attackers are exploiting compromised credentials to gain privileged access to internet‑exposed FortiGate firewalls and SSL‑VPN gateways. They create new admin accounts, delete or change existing passwords, and then lock legitimate administrators out of the devices. The FBI and U.S. Secret Service advisory reports over 86 000 compromised firewalls across 194 countries.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential‑management and lack of continuous monitoring of privileged accounts – a core control‑area for identity and access assurance.
- Highlights the need for defensible evidence that account creation, modification, and deletion events are logged, reviewed, and can be audited in real time.
- Shows that remediation goes beyond patching; organizations must prove they have processes to detect and remediate unauthorized account changes before they cause service disruption.
Who Is Affected – Enterprises across all sectors that expose FortiGate firewalls or SSL‑VPN gateways to the internet, including technology, finance, healthcare, and manufacturing firms.
Recommended Actions
- Immediately audit all admin accounts on FortiGate devices for unknown or duplicated credentials.
- Enforce multi‑factor authentication (MFA) for all remote‑access accounts and rotate passwords on a regular schedule.
- Deploy continuous monitoring of privileged‑account activity and integrate logs into a central SIEM for real‑time alerts on account creation or deletion.
- Apply the latest Fortinet firmware updates and harden management interfaces (e.g., restrict source IPs, disable unused services).
- Document remediation steps and retain evidence to satisfy audit requirements.
Technical Notes – The campaign leverages credential‑stuffing and password‑spraying attacks using leaked Fortinet password dumps, then cracks hashes with GPU clusters (Hashcat/Hashtopolis). Once inside, attackers enumerate Active Directory for privileged users and sell access to ransomware affiliates. Source: Help Net Security