The FBI and Secret Service have issued a warning about FortiBleed, an ongoing campaign targeting over 86,000 internet-facing Fortinet FortiGate firewalls and VPN gateways across 194 countries. The credential-stealing attacks exploit reused or leaked credentials to harvest and crack authentication data at scale. Attackers continue to scan exposed Fortinet devices, potentially locking organizations out of their systems by disabling accounts or changing passwords. The FortiBleed campaign has also served as an initial entry point for ransomware affiliates associated with INC/Lynx and Payload ransomware.
Federal agencies discovered details about the operation after hackers exposed their own backend server, revealing their internal workflow and methods. The attackers scanned the internet for exposed FortiGate portals, used automated scripts to identify devices, and collected credentials through credential stuffing and password spraying. Stolen credentials were then validated, organized by victim organization characteristics, and either sold to others or used directly for continued access. The FBI and Secret Service recommend organizations review all Fortinet accounts, restrict external device management, reset credentials, and terminate all admin VPN sessions.
Source: Read the full story at The Record
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
