A massive credential-compromise campaign dubbed "FortiBleed" has exposed tens of thousands of Fortinet devices worldwide, with researchers warning of persistent attacker access to affected enterprise environments. The operation highlights the growing trend of threat actors harvesting credentials from configuration files and exploiting weak password storage mechanisms.

Discovery and Scale of the Attack

The campaign was first flagged by security researcher Volodymyr Diachenko, who posted on LinkedIn about finding an attacker-controlled list of potentially working FortiGate passwords collected through various means. Further details emerged from SOCRadar after its team independently discovered an operational server belonging to an unnamed threat actor. That server contained a list of stolen FortiGate passwords, tools, automation infrastructure, victim lists, and some indications of who might be behind the attack.

According to independent analyses by SOCRadar, Hudson Rock, and security researcher Kevin Beaumont, the threat actors systematically collected configuration files from internet-facing Fortinet FortiGate firewalls and used them to recover working administrator credentials. The initial access vector remains unknown, but the attackers likely exploited multiple vulnerabilities in externally facing Fortinet applications.

While SOCRadar initially reported that the dataset contained working login credentials for over 30,791 devices, further analysis by Beaumont and Hudson Rock placed the affected devices at 75,000 — about 50% of all internet-facing Fortinet firewalls found on Shodan. Researchers found affected devices across 194 countries, spanning more than 21,000 domains. The dataset reportedly contains a mix of administrative and SSL VPN credentials recovered from compromised configuration files.

Attribution is ongoing, but SOCRadar noted that the tooling and targeting choices are consistent with Russian-speaking threat actors. CEO of watchTowr Benjamin Harris observed that the campaign is consistent with what he has been seeing lately, noting that modern exploitation is not always about immediate impact but about harvesting data that retains value long after the vulnerability has been patched.

Methodology and Technical Details

The operation is highly automated, allowing threat actors to collect, process, and crack credential material at a very large scale. SOCRadar found the top affected countries to be India, the United States, and Mexico, with a little under 12,000 compromised credentials between them. A credential-type breakdown revealed organization-specific credentials as the most probed, indicating targeted enterprise attacks.

Kevin Beaumont explained that the threat actors can log in remotely and gain remote access to the firewall and consequently the network. They can also change settings, including security controls, and create backdoor users. This level of access could allow attackers to pivot into internal networks, deploy malware, or exfiltrate sensitive data.

Vulnerability in Password Storage

Additional investigation highlighted why some Fortinet deployments proved easier to crack than others. Researchers noted that many affected systems stored administrator credentials using older hashing approaches that were significantly less resistant to offline password-cracking attacks than more recent implementations. Fortinet introduced PBKDF2-based password hashing for administrator credentials in FortiOS 7.2.11, 7.4.8, and 7.6.1, replacing the legacy SHA-256-based storage mechanism. However, when upgrading from earlier versions, existing administrator passwords remain stored as SHA-256 hashes until the corresponding administrator successfully logs in following the upgrade. This leads to many organizations continuing to store admin credentials using the older SHA-256 with salt hashing mechanisms.

The use of SHA-256 rather than more computationally expensive algorithms like PBKDF2 makes passwords much easier to crack offline. Attackers can use dictionary attacks or GPU-based brute force to recover passwords in a matter of hours or days, especially if the passwords are weak or reused from other services.

Impact and Recommendations

Researchers urged organizations to assume that credentials contained in exposed FortiGate configuration files have been compromised and to immediately rotate affected administrative and VPN passwords. In addition to password rotation, organizations should enforce multi-factor authentication (MFA) on all administrative and VPN accounts, restrict internet access to management interfaces, and review devices for signs of unauthorized access such as unknown user accounts or configuration changes.

Upgrading to supported FortiOS versions and replacing weaker or reused passwords was also advised. After upgrading FortiOS, administrators should require all administrators to log in to the firewall at least once to automatically convert the password storage to PBKDF2. Alternatively, admin passwords can be manually updated using a super_admin account.

Beyond immediate remediation, security teams should consider implementing a zero-trust architecture where administrative access is strictly controlled and monitored. Logging and alerting on authentication events should be reviewed for anomalies. Organizations should also audit their device configurations to ensure they are not storing passwords in plain text or using weak encryption.

Broader Industry Context

The FortiBleed campaign is part of a concerning trend where threat actors target network perimeter devices to obtain persistent access to enterprise environments. In recent years, similar campaigns have targeted Cisco, Palo Alto Networks, and other firewall vendors. Attackers often exploit known vulnerabilities that organizations have not patched, or they use stolen credentials obtained from previous breaches.

The scale of this campaign underscores the critical importance of securing network devices, which are often the first line of defense for many organizations. Firewalls and VPN concentrators are particularly attractive targets because they sit at the network edge and often have direct access to internal resources. Once compromised, these devices can become a foothold for ransomware, data theft, or lateral movement.

The use of configuration files as a source of credentials is a reminder that organizations must treat these files with the same level of protection as password databases. Configuration backups should be encrypted and stored securely. Additionally, administrators should use unique, complex passwords for each device and avoid password reuse across different systems.

Fortinet did not respond to requests for comment at the time of publication, but the company has previously released updates to address password storage weaknesses. Organizations running unsupported versions of FortiOS should prioritize upgrading to a supported version that includes PBKDF2-based hashing.

CEO of watchTowr Benjamin Harris commented that the uncomfortable reality is that modern exploitation isn't always about immediate impact: it's about harvesting data that retains value long after the underlying vulnerability has been patched. This statement captures the essence of the FortiBleed campaign, where credentials harvested from vulnerable devices can be used months or years later for attacks.

Source: Network World News