NCSC Urges Fortinet Users to Investigate Global Firewall and VPN Targeting
Summary
The NCSC says a global campaign targeted internet-facing FortiGate and VPN portals using brute-force, dictionary and credential-stuffing attempts, and urges organisations to investigate possible impact and follow mitigation advice.
Key points
- A threat actor leaked a database of credentials following attempts against internet-facing FortiGate and VPN portals.
- The NCSC says there are indications of potential impact in the UK.
- Organisations using Fortinet edge devices with SSL VPN enabled should investigate potentially malicious device activity and monitor for unusual network activity.
- The NCSC advises organisations to check potentially affected domains with a FortiBleed asset checker and follow Fortinet’s guidance.
- The NCSC’s free Early Warning service alerts UK organisations to malicious activity affecting their networks.
Article Details
- Event Type
- Global campaign targeting Fortinet firewalls and VPN gateways, involving brute-force, dictionary, and credential-stuffing attempts against internet-facing portals; a threat actor subsequently leaked a database of credentials.
- Impact
- Some potential impact was indicated in the UK. Organisations may face compromised credentials and malicious activity affecting Fortinet edge devices and networks; the source does not confirm the extent of impact.