SOCRadar Details FortiBleed Campaign Using FortiGate Firewalls to Steal Credentials
Summary
SOCRadar describes FortiBleed as an ongoing campaign using FortigateSniffer to harvest credentials from compromised FortiGate firewalls. Researchers report 659 harvesting pipelines and more than 110 million stolen credentials.
Key points
- SOCRadar says the campaign has been active since at least February and targets more than 430,000 FortiGate firewalls, with affected organizations in nearly 200 countries.
- The Golang tool FortigateSniffer abuses FortiOS diagnostic commands to passively capture authentication traffic across 24 protocols without installing traditional malware.
- Attackers reportedly scan for exposed firewalls, then use credential-stuffing and brute-force attacks against administrative interfaces and SSH to gain access.
- SOCRadar reports 659 credential-harvesting pipelines and more than 110 million stolen credentials, including RADIUS, NTLM, and Kerberos material.
- The reported attack chain uses validated credentials for password spraying, Active Directory enumeration, SMB access, and lateral movement; attackers also steal files and reuse web-session cookies.
- SOCRadar assesses that the actor is likely a financially motivated initial access broker and possibly Russian, citing Cyrillic comments in campaign tooling.
- Recommended steps include rotating Fortinet-related credentials, enforcing MFA, removing management interfaces from direct internet exposure, and reviewing gateway and authentication logs.
Article Details
- Attack Vectors
- SOCRadar reports that attackers scan the Internet for exposed FortiGate firewalls and other edge services, then prioritize targets using organization and revenue information.
- Attackers reportedly use credential-stuffing and brute-force attacks against FortiGate administrative interfaces and SSH services to obtain credentials and footholds.
- After compromising a firewall, attackers deploy FortigateSniffer to use FortiOS diagnostic commands to passively capture authentication traffic and extract credentials, hashes, session cookies, and identity data.
- According to SOCRadar, attackers use GPU infrastructure to crack captured hashes and use validated credentials for password spraying, Active Directory enumeration, SMB access, and lateral movement.
- The reported attack chain culminates in theft of files from network shares and reuse of stolen Web-session cookies to access internal applications.
- Defensive Notes
- Rotate credentials associated with Fortinet VPNs and administrative interfaces, and consider rotating credentials across other access points.
- Enforce multi-factor authentication.
- Remove FortiGate management interfaces from direct Internet exposure.
- Review gateway and authentication logs for suspicious activity, including logins at atypical times or from atypical locations.
MITRE ATT&CK
T1021.002 · SMB/Windows Admin SharesThe reported attack chain includes SMB access and lateral movement into victim networks.T1039 · Data from Network Shared DriveThe reported attack chain includes theft of sensitive files from network shares.T1040 · Network SniffingFortigateSniffer reportedly passively captures authentication traffic from compromised FortiGate firewalls.T1078 · Valid AccountsAttackers reportedly use obtained and validated credentials to gain footholds and access internal applications.T1087.002 · Domain AccountActive Directory enumeration is reported as part of the campaign's post-compromise activity.T1110.001 · Password GuessingAttackers reportedly use brute-force attacks against FortiGate administrative interfaces and SSH services.T1110.002 · Password CrackingSOCRadar reports that attackers use GPU infrastructure to crack hashes captured by the tool.T1110.003 · Password SprayingSOCRadar reports that validated credentials are used for password spraying.T1110.004 · Credential StuffingAttackers reportedly use credential-stuffing attacks against FortiGate administrative interfaces and SSH services.T1550.004 · Web Session CookieThe article reports reuse of stolen Web-session cookies to gain authenticated access to internal applications.T1595.001 · Scanning IP BlocksSOCRadar reports that attackers scan the Internet for exposed FortiGate firewalls and other edge services during reconnaissance.
People
Vendors
Products
Fortinet FortiGateSOCRadar uncovered the broader FortiBleed campaign, in which attackers use the FortigateSniffer tool to turn compromised FortiGate firewalls into passive credential stealers across dozens of protocols.FortiOSThe FortigateSniffer tool abuses FortiOS diagnostic commands to capture authentication traffic passively.
Tools
CyberStrikeFurther analysis suggests that parts of the workflow also may have been assisted by CyberStrike, an open source, AI-powered autonomous penetration testing agent, according to the researchers.FortigateSnifferSOCRadar uncovered the broader FortiBleed campaign, in which attackers use the FortigateSniffer tool to turn compromised FortiGate firewalls into passive credential stealers across dozens of protocols.
Countries
IndiaKey targets of the campaign are small-to-medium-sized businesses (SMBs) with less than 200 employees, particularly in the US and India, according to SOCRadar.United StatesKey targets of the campaign are small-to-medium-sized businesses (SMBs) with less than 200 employees, particularly in the US and India, according to SOCRadar.