cyber.hendryadrian.com
Security News · unit42.paloaltonetworks.com

Unit 42 Details ‘FortiBleed’ Credential-Spraying Campaign Targeting Fortinet Devices

· Original article ↗

Summary

Unit 42 reports “FortiBleed” password spraying against exposed Fortinet devices, followed by credential extraction, offline cracking and reuse. MSSQL targeting was observed; Sophos targeting was reported. An IAB’s sale claim remains unvalidated.

Key points

  • Unit 42 identified large-scale password spraying against internet-exposed Fortinet devices and observed attempts targeting MSSQL services; Sophos targeting was reported.
  • The reported attack process includes extracting device configuration files and stored credentials, cracking credentials offline, then reusing them to maintain administrator access.
  • Unit 42 says attackers used curated password lists, likely built partly from prior breaches and successful vulnerability exploitation.
  • Unit 42 observed an initial access broker on Exploit[.]in claiming responsibility and offering harvested credentials for sale; Unit 42 has not validated the claim.
  • Recommended defenses include MFA, keeping management interfaces off the public internet, changing default credentials, disabling unused accounts, and patching systems.
  • Unit 42 recommends reviewing remote-access logs for successful logins following high volumes of password failures.

Article Details

Event Type
Large-scale password-spraying and credential-theft campaign targeting internet-exposed Fortinet devices, with attempts against MSSQL and reports of Sophos devices also being targeted.
Impact
Stolen configuration files and stored credentials were reportedly cracked offline and reused to gain persistent administrator access to compromised devices. The actor may have exploited a privilege-escalation vulnerability before extracting configurations. An initial access broker claimed responsibility and offered credentials for sale, but Unit 42 had not validated the claim.

MITRE ATT&CK

T1005 · Data from Local SystemAttackers reportedly extracted device configuration files, including stored credentials, from compromised systems.T1068 · Exploitation for Privilege EscalationThe actor may have exploited a privilege-escalation vulnerability before extracting configurations; Unit 42 described this as conditional.T1078 · Valid AccountsCompromised credentials were reportedly reused to log into devices and maintain administrator access.T1110.002 · Password CrackingStolen credentials were reportedly cracked offline and added to password lists for further attempts.T1110.003 · Password SprayingUnit 42 reported password spraying against internet-exposed Fortinet, Sophos, and MSSQL services.T1555 · Credentials from Password StoresAttackers reportedly harvested stored credentials from device configurations.

Vendors

FortinetUnit 42 reported the “FortiBleed” campaign, a large-scale password spraying and credential theft operation targeting Fortinet devices, with observed activity also affecting MSSQL and reported Sophos systems.SophosUnit 42 reported the “FortiBleed” campaign, a large-scale password spraying and credential theft operation targeting Fortinet devices, with observed activity also affecting MSSQL and reported Sophos systems.

Products

Fortinet FortiGate[Domains/URLs ] darkweb forum and reported vendor-facing sources – Exploit[.]in, FortiGateMSSQLUnit 42 reported the “FortiBleed” campaign, a large-scale password spraying and credential theft operation targeting Fortinet devices, with observed activity also affecting MSSQL and reported Sophos systems.

Related Articles