FortiBleed still a bleeding nuisance as FBI confirms ongoing attacks
FBI and Secret Service confirm ongoing FortiBleed attacks on 86,644 Fortinet devices across 194 countries, with INC/Lynx and Payload ransomware affiliates using stolen access.
A joint FBI and US Secret Service advisory confirms criminals using FortiBleed-linked credentials are compromising internet-facing FortiGate firewalls and SSL VPN gateways, with SOCRadar verifying 86,644 compromised devices across 194 countries. Attackers use credential stuffing, password spraying, and GPU-accelerated offline hash cracking, then create new accounts for persistence while locking out legitimate administrators. Initial access brokers supplied network access to ransomware affiliates, with INC/Lynx and Payload implicated and at least 12 confirmed ransomware attacks. Agencies recommend restricting internet-facing management access, terminating active sessions, resetting passwords, and enabling phishing-resistant MFA.
- SOCRadar verified 86,644 compromised Fortinet devices across 194 countries
- Attackers delete or change admin passwords, create new accounts, and move laterally
- Credential stuffing, password spraying, and GPU-based offline hash cracking enable intrusions
- INC/Lynx and Payload ransomware affiliates used FortiBleed access; 12 attacks confirmed
- FBI urges restricting internet-facing management access and phishing-resistant MFA
Full article311 words · extracted from theregister.com · click to collapse
security
Tens of thousands more victims and more ransomware groups getting in on the act
The FBI and US Secret Service (USSS) say criminals using credentials linked to the FortiBleed campaign are locking organizations out of their Fortinet firewalls.
The agencies published a joint advisory on Tuesday, citing SOCRadar's verification of more than 86,644 compromised devices across 194 countries.
"Based on initial responses, some victims may get locked out of their Fortinet devices if the threat actor either deletes or changes the password for original accounts on the system," their advisory [PDF] states.
REG AD
"During the initial intrusion, threat actors create new accounts not previously on the device. In certain cases, threat actors delete existing accounts to block organizations from accessing affected devices and to maintain persistence on the system while attempting lateral movement within the environment."
REG AD
The campaign targets internet-facing FortiGate firewalls and SSL VPN gateways. Criminals use credentials from earlier breaches and infostealer logs for credential stuffing and password spraying, then extract password hashes from compromised devices and crack them offline using GPU-accelerated clusters.
The agencies urged organizations to restrict internet-facing management access, terminate active administrative and VPN sessions, reset passwords, and enable phishing-resistant multi-factor authentication.
The advisory also links FortiBleed to ransomware campaigns, saying initial access brokers supplied compromised-network access to ransomware affiliates. The Register previously reported on the connection, identified by SOCRadar.
The current evidence points to affiliates working for the INC/Lynx and Payload ransomware groups making use of the credentials, and SOCRadar said in July that it had seen at least 12 confirmed ransomware attacks stemming from FortiBleed.
The agencies encouraged victims to report incidents, while noting that organizations were not obliged to provide information in response to this advisory.
The FBI and the Secret Service said victim reports could help identify indicators of compromise and warned against paying ransoms. ®