FortiBleed Campaign Compromises Over 86,000 Fortinet Firewalls Globally

The FBI and the U.S. Secret Service have issued a joint alert regarding 'FortiBleed,' a massive credential-harvesting campaign that has already compromised 86,644 Fortinet FortiGate devices and SSL VPN gateways across 194 countries. The attackers exploit reused or leaked credentials and the legacy storage of passwords using SHA-256 to gain access and, in some cases, lock out legitimate administrators by changing or deleting passwords. Investigations revealed that the campaign operators accidentally exposed their own backend infrastructure through an open directory, allowing investigators to understand their tactics from the inside. The alert underscores the urgent need for organizations to implement multi-factor authentication and update password-hashing mechanisms on exposed devices.

Source: Security Affairs