A massive credential-compromise campaign dubbed “FortiBleed” has been found to expose tens of thousands of Fortinet devices worldwide, with researchers warning of persistent attacker access to affected enterprise environments. The campaign, first flagged by security researchers, involves the systematic collection of configuration files from internet-facing Fortinet FortiGate firewalls, from which working administrator credentials are recovered. This operation highlights the growing trend of credential harvesting as a primary attack vector in modern cyber threats.
The scale of the compromise is staggering. Independent analyses by multiple security firms, including SOCRadar, Hudson Rock, and prominent researcher Kevin Beaumont, place the number of affected devices at around 75,000—roughly 50% of all internet-facing Fortinet firewalls visible on Shodan. The affected devices span across 194 countries and more than 21,000 domains, with the top impacted nations being India, the United States, and Mexico, accounting for nearly 12,000 compromised credentials combined.
The threat actors reportedly maintained an operational server containing a list of stolen FortiGate passwords, automation tools, a victim list, and other indicators pointing to a well-organized criminal group. While attribution is still ongoing, researchers at SOCRadar noted that the tooling and targeting choices are consistent with Russian-speaking threat actors. The initial access vector remains unknown, but it is suspected that multiple vulnerabilities in externally facing Fortinet applications were exploited over time to collect the configuration files.
Explaining the potential impact, security experts warned that attackers with recovered credentials can log in remotely to the firewall, gaining full access to the network. They can change security settings, create backdoor users, and maintain persistent access long after the original vulnerabilities are patched. CEO of watchTowr Benjamin Harris emphasized that modern exploitation is often about harvesting data that retains value even after patches are applied.
A critical aspect of the FortiBleed campaign is the use of outdated password hashing mechanisms. Many affected systems stored administrator credentials using older SHA-256 with Salt hashing, which is significantly less resistant to offline password-cracking attacks compared to more recent implementations. Fortinet introduced PBKDF2-based password hashing in FortiOS versions 7.2.11, 7.4.8, and 7.6.1, replacing the legacy SHA-256 storage mechanism. However, when upgrading from earlier versions, existing administrator passwords remain stored as SHA-256 hashes until the corresponding administrator logs in after the upgrade. This means many organizations continue to store admin credentials using the weaker hashing, making them vulnerable to cracking.
Researchers from Arctic Wolf explained that the use of PBKDF2 (Password-Based Key Derivation Function 2) strengthens the hash by adding computational cost, making brute-force attacks significantly slower. Migrating to PBKDF2 requires administrators to log in after upgrading, which automatically converts the password storage. Alternatively, a super_admin account can manually update passwords. Failure to take this step leaves the organization exposed, as older hashes can be cracked with commodity hardware in a matter of hours if the password is weak.
The FortiBleed campaign is a stark reminder of the dangers posed by credential harvesting. In recent years, similar campaigns have targeted Cisco and Palo Alto VPNs, where attackers brought their own passwords or exploited configuration files. The trend indicates a shift from vulnerability exploitation to credential theft as a primary means of gaining initial access. Threat actors are increasingly focusing on identity-based attacks, as they are often easier to execute and harder to detect.
Organizations are urged to assume that any credentials contained in exposed FortiGate configuration files have been compromised. Immediate steps include rotating all administrative and SSL VPN passwords, enforcing multi-factor authentication (MFA) for all administrative access, and restricting internet access to management interfaces. Additionally, devices should be reviewed for signs of unauthorized access, such as unexpected user accounts or changes in firewall rules.
Upgrading to supported FortiOS versions is critical, but equally important is ensuring that after upgrading, all administrators log in at least once to trigger the conversion to PBKDF2 hashing. Weak or reused passwords should be replaced immediately, and organizations should consider implementing password managers to enforce strong, unique credentials. Network segmentation and regular auditing of firewall logs can also help detect suspicious activity.
The FortiBleed campaign underscores the evolving nature of cyber threats. While vulnerabilities continue to be a concern, the focus has shifted to the theft of credentials that allow attackers to bypass perimeter defenses entirely. As the line between network security and identity security blurs, defenders must adopt a comprehensive approach that includes robust authentication mechanisms, continuous monitoring, and proactive credential management. The lesson from FortiBleed is clear: assume breach, enforce least privilege, and never underestimate the value of strong cryptographic practices.
Source:Network World News