Researchers Report Global Campaign Targeting 73,932 Fortinet Firewall URLs
Summary
Researchers report that a Russian-speaking group targeted 73,932 Fortinet firewall URLs across 194 countries, using exposed configurations and offline credential cracking. They say some intrusions reached internal networks, including a Turkish defense contractor.
Key points
- Researchers cited in the article counted 73,932 targeted firewall URLs across 194 countries and 21,632 associated domains.
- The article says attackers likely accessed exposed FortiGate management interfaces and used exported configurations to recover credentials offline; some devices reportedly retained older SHA-256-with-salt password hashes.
- The reported estimates include 1.16 billion credential attempts against more than 320,000 FortiGate targets and 2.1 billion attempts against more than 160,000 MSSQL servers.
- Diachenko's research reportedly found full network compromises in Japan, Taiwan, Vietnam, Iraq, and Turkey, including a Turkish NATO defense contractor from which classified documents were reportedly exfiltrated.
- Beaumont says the dataset's victim classifications may indicate that access was being packaged for sale; the article does not establish that conclusion as confirmed.
- Recommended steps include removing unnecessary public access to management interfaces, updating FortiOS and rotating credentials, enabling MFA, and checking for suspicious logins or backdoor accounts.
Article Details
- Event Type
- Credential-theft and network-compromise campaign targeting Fortinet firewalls and VPN gateways
- Impact
- The article reports 73,932 targeted firewall URLs across 194 countries and 21,632 affected domains. It describes an estimated 1.16 billion credential attempts against FortiGate targets and 2.1 billion brute-force attempts against MSSQL servers. Researchers reported confirmed network compromises in multiple countries, including the exfiltration of classified defense documents from a Turkish NATO defense contractor. The article attributes the operation to a Russian-speaking cybercriminal group, but does not name the group.
MITRE ATT&CK
T1078 · Valid AccountsRecovered credentials reportedly enabled perimeter access and subsequent access to internal networks.T1110.001 · Password GuessingThe article reports large-scale brute-force attempts against FortiGate targets and MSSQL servers.T1110.002 · Password CrackingThe operators reportedly extracted configuration data and cracked SSL VPN authentication hashes offline.
People
Kevin BeaumontThe article cites his analysis of the dataset, including its scale, likely exposure of Fortinet management interfaces, and the significance of the leaked data.Volodymyr “Bob” DiachenkoThe article identifies him as the security researcher who discovered the campaign and cites his investigative report on its operators, scale, and confirmed compromises.
Vendors
Products
Fortinet FortiGate#FortinetFortiOSRemove Internet Exposure: Immediately ensure the FortiOS Management Interface is not exposed to the public internet unless absolutely necessary.Microsoft Active DirectoryCompromises led to internal network access, Active Directory pivoting, and data exfiltration.MSSQLThe attackers performed billions of credential attempts against FortiGate and MSSQL targets.
Tools
Countries
Chileð¨ð± Chile (CL) 2,015Colombiað¨ð´ Colombia (CO) 2,436Indiað®ð³ India (IN) 9,629IraqDiachenko’s research confirmed full network compromises at multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey.JapanDiachenko’s research confirmed full network compromises at multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey.Malaysiað²ð¾ Malaysia (MY) 2,066Mexicoð²ð½ Mexico (MX) 3,197TaiwanDiachenko’s research confirmed full network compromises at multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey.Thailandð¹ð Thailand (TH) 2,939TurkeyDiachenko’s research confirmed full network compromises at multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey.United Arab Emiratesð¦ðª United Arab Emirates (AE) 1,988United Statesðºð¸ United States (US) 6,352VietnamDiachenko’s research confirmed full network compromises at multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey.
Industries
Construction & Eng.Construction & Eng. 528construction materialsConstruction Materials 587EducationEducation 346Financial ServicesFinancial Services 460Government servicesGovernment Services 454Healthcare ServicesHealthcare Services 365Industrial EquipmentIndustrial Equipment 467IT servicesTelecommunications and IT Services took the heaviest hits, but the attacker’s net was cast incredibly wide.ManufacturingManufacturing 351TelecommunicationsTelecommunications and IT Services took the heaviest hits, but the attacker’s net was cast incredibly wide.