The FBI has warned that FortiBleed attacks continue to target internet-exposed Fortinet FortiGate firewalls and SSL VPN gateways. In some incidents, attackers take control of administrator accounts and prevent legitimate users from managing their devices.
The campaign relies on stolen or compromised credentials to gain access. Meanwhile, the FBI says the attack chain has provided an initial entry point for ransomware affiliates, including INC/Lynx and Payload.
Stolen Credentials Provide a Route Into Networks
Attackers obtain working logins from previous leaks, infostealer records, credential stuffing and password spraying.
After accessing a device, they extract additional authentication data. They then use a distributed GPU cluster running Hashcat and Hashtopolis to crack stolen password hashes offline.
As a result, the compromise can expose more credentials than those used for the initial login.
In some cases, attackers create new administrator accounts before deleting existing accounts or changing their passwords. This locks legitimate administrators out while giving the intruders control.
The attackers subsequently establish persistence and attempt to move into other parts of the network.
FortiBleed Exposure Revealed a Large Credential Operation
FortiBleed came to light in June after attackers accidentally exposed a server containing usernames and plaintext passwords. The dataset covered 73,932 firewall URLs across 194 countries.
The discovery revealed a substantial credential-harvesting operation. However, researchers could not initially determine how the attackers had obtained the configuration data.
In July, SOCRadar linked the campaign to INC and Lynx ransomware after accessing negotiation panels for both operations on a campaign server.
SOCRadar’s latest count puts the number of compromised devices at 86,644. That figure represents its updated assessment rather than the original June dataset.
Exposed Tools Show How Attackers Selected Victims
The accidentally exposed backend also contained scripts, operational tools and target information.
Researchers found automated scanning tools for exposed FortiGate SSL VPN portals, alongside the distributed password-cracking infrastructure. Other scripts checked credentials, filtered out honeypots and identified organizations.
Additionally, the tooling helped prioritize targets according to revenue and network structure.
Working VPN configurations and target lists suggested that the operator was preparing compromised access for sale. Consequently, FortiBleed attacks could provide access for other criminals as well as the original intruders.
The FBI’s warning connects that access pipeline to ransomware activity.
Recovery May Require More Than Password Changes
The FBI cautioned that installing patches and resetting Fortinet passwords may not fully resolve a compromise.
Its recommendations include restricting external access, terminating all active VPN sessions and enforcing multifactor authentication. Administrators should also review logs for unauthorized account changes and other suspicious activity.
These checks can help identify access or configuration changes that remain after an initial password reset.
Furthermore, the FBI recommended using PBKDF2 for administrator password storage instead of legacy SHA-256 hashes. PBKDF2 provides stronger resistance to the offline password-cracking methods described in the campaign.
Organizations investigating suspected compromise should therefore examine both device access and signs of movement elsewhere in their networks.
0 responses to “FBI Warns FortiBleed Attacks Lock Administrators Out of FortiGate Devices”