CISA Urges Fortinet Customers to Harden Devices Amid FortiBleed Campaign
Summary
CISA urged organizations to harden internet-facing Fortinet devices after reports of the FortiBleed credential-theft campaign. SOCRadar reported more than 86,000 credentials, while researchers and Huntress described verified logins and affected organizations.
Key points
- SOCRadar reported a database of more than 86,644 working credentials across 194 countries; the credentials were collected from internet-facing Fortinet infrastructure.
- Researcher Kevin Beaumont and Hudson Rock said they verified that some logins were valid and recent; some credentials may have been stolen earlier and not rotated.
- Bob Diachenko attributed the campaign to a Russian-speaking actor and said at least four organizations were fully compromised; these claims are attributed, not independently established in the article.
- Diachenko described interception of SSL VPN authentication, hash cracking, and movement into internal Active Directory environments.
- Huntress said it identified 845 partner organizations affected by the credential dump.
- CISA advised terminating active sessions, resetting credentials, using PBKDF2 for administrator logins, reviewing logs, enabling phishing-resistant MFA, and restricting management access.
Article Details
- Event Type
- Large-scale credential theft and brute-force campaign targeting internet-facing Fortinet devices.
- Impact
- SOCRadar reported a database of over 86,644 confirmed working credentials across 194 countries; the article says the campaign likely affects more than 86,000 firewalls and VPNs. Bob Diachenko reported that at least four organizations were fully compromised, while Huntress identified 845 partner organizations as specifically impacted by the credential dump. The reported attack activity included an estimated 1.16 billion credential attempts against more than 320,000 FortiGate targets and 2.1 billion brute-force attempts against over 160,000 MSSQL servers. Diachenko attributed the campaign to a Russian-speaking threat actor; the actor is not named.
MITRE ATT&CK
People
Bob DiachenkoSecurity researcher who reported that the campaign was orchestrated by a Russian-speaking threat actor and described the reported credential cracking and movement into internal Active Directory environments.Kevin BeaumontSecurity researcher who, with Hudson Rock, worked with impacted organizations and verified that the compromised logins were valid and fairly recent.
Vendors
Products
Fortinet FortiGateThe attackers are estimated to have executed roughly 1.16 billion credential attempts targeting more than 320,000 FortiGate targets, as well as 2.1 billion brute-force attempts against over 160,000 MSSQL servers.MSSQLThe attackers are estimated to have executed roughly 1.16 billion credential attempts targeting more than 320,000 FortiGate targets, as well as 2.1 billion brute-force attempts against over 160,000 MSSQL servers.
Tools
Industries
Critical infrastructureAccording to Hudson Rock, the campaign has hit thousands of organizations, “including major government entities and critical infrastructure providers”.GovernmentAccording to Hudson Rock, the campaign has hit thousands of organizations, “including major government entities and critical infrastructure providers”.