SOCRadar Reports FortiBleed Campaign Targeting 430,000 FortiGate Firewalls
Summary
SOCRadar reports that FortiBleed targets FortiGate and other systems to harvest credentials and sell access. It says more than 19,000 identified targets remain actively monitored and attributes a defense contractor compromise to the campaign.
Key points
- SOCRadar says more than 430,000 FortiGate firewalls are within the campaign’s scope; of 80,000 identified targets, more than 19,000 were still being actively sniffed.
- The investigation reportedly found hundreds of servers and more than 650 credential-harvesting pipelines; SOCRadar estimates over 110 million credentials were compromised.
- The reported attack chain includes scanning for exposed appliances, SSH brute-force attacks, capturing credentials and hashes, cracking them, and using stolen credentials for lateral movement.
- SOCRadar says FortigateSniffer abuses a legitimate FortiOS diagnostic command to capture authentication traffic across 24 protocols.
- SOCRadar reports that Kerberos hash cracking preceded targeted exfiltration of DFS backup data from a NATO-aligned defense contractor on June 15.
- The campaign has reportedly been active since at least February and also targets systems and credentials associated with Sophos, RDWeb, MSSQL, RDP, Citrix, RADIUS, NTLM and Kerberos.
Article Details
- Event Type
- Multi-vendor credential-harvesting and initial-access campaign targeting exposed firewalls and remote-access systems.
- Impact
- SOCRadar estimates that more than 110 million credentials were compromised; it reports over 19,000 identified FortiGate targets were still being actively sniffed. The campaign culminated, according to SOCRadar, in the targeted exfiltration of DFS backup data from a NATO-aligned defense contractor. MSPs and IT-services firms are among the targets, with notable emphasis on the United States and India. The threat actor is described as likely financially motivated and possibly Russian-speaking; collaboration with Russian state-sponsored groups or sales of access to ransomware gangs are possibilities, not confirmed.
MITRE ATT&CK
T1039 · Data from Network Shared DriveSOCRadar reports targeted exfiltration of DFS backup data and theft of sensitive data from network shares.T1040 · Network SniffingDeployed network sniffers capture authentication traffic, including cleartext credentials and password hashes.T1110.001 · Password GuessingThe actor compromises exposed appliances through SSH brute-force attacks.T1110.002 · Password CrackingThe campaign includes cracking captured credentials and offline cracking of Kerberos hashes.T1550.004 · Web Session CookieAttackers use stolen session cookies to establish persistent access.T1595 · Active ScanningThe actor uses Masscan and Shodan to identify vulnerable FortiGate appliances.
Vendors
CitrixMSSQL credentials, RDPs, Citrix SSL-VPNs, and RADIUS, NTLM, and Kerberos data are also within the campaign’s scope.FortinetDiscovered last week, the campaign has been ongoing since at least February, and was initially believed to be Fortinet-exclusive.SophosThe earliest artifacts associated with the campaign are from February and point to the scanning of Sophos SSL-VPN and RDWeb portals.
Products
Fortinet FortiGateA Russian initial access broker (IAB) is targeting over 430,000 FortiGate firewalls as part of the FortiBleed credential-harvesting campaign, SOCRadar reports.FortiOSFortigateSniffer, the most important tool in the operation, abuses the legitimate FortiOS diagnostic command to passively capture authentication traffic across 24 protocols.Microsoft Active DirectoryNext, they deploy network sniffers to capture cleartext credentials and password hashes, and then crack, validate, and use them for lateral movement against Active Directory domains and other services.RDWebThe earliest artifacts associated with the campaign are from February and point to the scanning of Sophos SSL-VPN and RDWeb portals.Sophos SSL-VPNThe earliest artifacts associated with the campaign are from February and point to the scanning of Sophos SSL-VPN and RDWeb portals.
Tools
CyberStrikeThe sniffer was likely built with the assistance of the AI-powered autonomous penetration testing agent CyberStrike.FortigateSniffertargets, more than 19,000 are still being actively sniffed, using a custom Golang tool dubbed FortigateSniffer.masscanAs part of the campaign, the threat actor uses tools such as Masscan and Shodan to identify vulnerable FortiGate appliances, and then compromises them in SSH brute-force attacks.ShodanAs part of the campaign, the threat actor uses tools such as Masscan and Shodan to identify vulnerable FortiGate appliances, and then compromises them in SSH brute-force attacks.