Infostealer Logs Linked to 77% of Credentials in F5 Credential-Stuffing Campaign
Summary
An analysis matched 54 of 70 credentials used in F5 BIG-IP credential-stuffing attempts to infostealer logs, mostly ADFS/STS credentials. The source IP was attributed to a reportedly compromised FortiGate used as a proxy.
Key points
- Defused Cyber reported attempts to access F5 infrastructure using seemingly legitimate corporate credentials.
- The article says 54 of 70 email-and-password combinations matched infostealer logs in Hudson Rock and Cavalier data, a 77% match rate.
- The matched credentials were primarily for ADFS and STS, rather than F5-specific passwords.
- The article lists employee credentials associated with organizations including Rolls-Royce, Ericsson, Belgian Police and others; it does not establish successful access to those organizations’ networks.
- The source IP, 219.75.254.166, was identified as hosting a Fortinet FortiGate device; experts assessed it may have been compromised and used as a proxy.
- The article describes a pipeline in which infostealer logs are filtered for corporate credentials and sold to initial access brokers.
Article Details
- Event Type
- Credential-stuffing campaign against F5 BIG-IP devices using credentials reportedly harvested from infostealer infections, with a compromised Fortinet FortiGate described as the attack proxy.
- Impact
- Of 70 credential combinations observed in the campaign, 54 (77%) reportedly matched infostealer logs. The credentials were primarily for corporate ADFS and STS services, and included employees of multiple organizations. The article describes attempted access and the risk of network compromise, but does not establish that the targeted organizations were successfully breached.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 219[.]75[.]254[.]166 | Source IP reported for the credential-stuffing activity; the article says Shodan data showed it hosted a Fortinet FortiGate-60E and that this compromised device was likely used as an attack proxy. |
MITRE ATT&CK
People
Vendors
F5A large credential stuffing campaign targeted F5 BIG-IP devices using credentials harvested from Infostealer infections rather than from direct F5 breaches.FortinetAttackers bought or scraped Infostealer logs, then stuffed ADFS/STS SSO credentials against edge devices—often via compromised Fortinet appliances—to bypass MFA and gain network access.
Products
ADFSAttackers bought or scraped Infostealer logs, then stuffed ADFS/STS SSO credentials against edge devices—often via compromised Fortinet appliances—to bypass MFA and gain network access.F5 BIG-IPA large credential stuffing campaign targeted F5 BIG-IP devices using credentials harvested from Infostealer infections rather than from direct F5 breaches.FortiGate-60EAccording to Shodan data, the source IP (219.75.254.166) actually hosts a Fortinet FortiGate-60E firewall from OPTAGE Inc.OWAof Infostealers, taking corporate credentials previously used for internal portals (like ADFS, STS, and OWA) and “stuffing” them against external-facing F5 interfaces, hoping for password reuse or lack of MFA.STSAttackers bought or scraped Infostealer logs, then stuffed ADFS/STS SSO credentials against edge devices—often via compromised Fortinet appliances—to bypass MFA and gain network access.