FBI and Secret Service Warn FortiBleed Campaign Can Lock Out Fortinet Users and Enable Ransomware
Summary
The FBI and Secret Service warn that the active FortiBleed campaign uses stolen credentials to compromise Fortinet firewalls and VPN gateways, lock out users, and provide access to ransomware affiliates.
Key points
- Attackers use stolen credentials to access exposed Fortinet firewalls and VPN gateways and create unauthorized administrator accounts.
- Attackers can disable accounts or change passwords, potentially locking legitimate users out; standard patching and password resets may be insufficient.
- The campaign has been used to provide initial access to ransomware affiliates, including INC/Lynx and Payload.
- SOCRadar initially verified more than 86,644 compromised devices across 194 countries; a later investigation found more than 400,000 or 450,000 firewalls targeted by the wider operation.
- The FBI and Secret Service recommend restricting or removing internet-based administration, resetting credentials, enabling multifactor authentication, reviewing users and logs, and using secure credential storage.
Article Details
- Event Type
- Active credential-compromise campaign targeting Fortinet firewalls and VPN gateways, with reported use as an initial access route for ransomware affiliates.
- Impact
- Attackers can use stolen credentials to create administration accounts, change passwords, and disable accounts, potentially locking organizations out. The campaign has also been observed providing initial access for ransomware affiliates. SOCRadar reported more than 86,644 compromised devices across 194 countries in its initial investigation and later estimated that the wider operation targeted more than 400,000 or 450,000 firewalls.