A massive credential-compromise campaign dubbed 'FortiBleed' has been found to expose tens of thousands of Fortinet devices worldwide, with researchers warning of persistent attacker access to affected enterprise environments. The campaign, first flagged by security researcher Volodymyr Diachenko, centers on an attacker-controlled list of potentially working FortiGate passwords collected through various means. Further analysis by SOCRadar, Hudson Rock, and security researcher Kevin Beaumont revealed that the threat actors systematically collected configuration files from internet-facing Fortinet FortiGate firewalls and used them to recover working administrator credentials.

The scale of the compromise is staggering: independent analyses place the number of affected devices at around 75,000, representing approximately 50% of the total internet-facing Fortinet firewalls found on Shodan. The dataset contains working login credentials for these devices, spanning 194 countries and more than 21,000 domains. The top affected countries include India, the United States, and Mexico, which together account for nearly 12,000 compromised credentials. The credential types range from administrative accounts to SSL VPN credentials, with organization-specific credentials being the most targeted, indicating a focus on enterprise environments.

The operation appears to be highly automated, allowing threat actors to collect, process, and crack credential material at a very large scale. SOCRadar researchers noted that the tooling and targeting choices are consistent with Russian-speaking threat actors, though attribution is ongoing. The initial access vector remains unknown, but the campaign is believed to have exploited multiple vulnerabilities in externally facing Fortinet applications over time. As watchTowr CEO Benjamin Harris noted, 'The uncomfortable reality is that modern exploitation isn't always about immediate impact. It's about harvesting data that retains value long after the underlying vulnerability has been patched.'

Cracked passwords and global reach

While SOCRadar initially reported over 30,791 devices with working credentials, further analysis by Beaumont and Hudson Rock raised the count to 75,000. The dataset includes a mix of administrative and SSL VPN credentials recovered from compromised configuration files. Beaumont explained that with these credentials, threat actors can log in remotely, gain access to the firewall, change settings (including security controls), and create backdoor users. This effectively gives attackers persistent access to the network behind the firewall.

Researchers found that many affected systems stored administrator credentials using older hashing approaches, specifically SHA-256 with salt, which are significantly less resistant to offline password-cracking attacks than modern implementations. Fortinet introduced PBKDF2-based password hashing for administrator credentials in FortiOS versions 7.2.11, 7.4.8, and 7.6.1, replacing the legacy SHA-256 mechanism. However, when upgrading from earlier versions, existing administrator passwords remain stored as SHA-256 hashes until the corresponding administrator successfully logs in following the upgrade. This has led many organizations to continue storing admin credentials using the weaker hashing mechanism, making them vulnerable to cracking.

Arctic Wolf researchers detailed this issue in a blog post, emphasizing that organizations must ensure administrators log in after upgrading FortiOS to trigger the automatic conversion to PBKDF2. The legacy hashing makes it easier for attackers to recover plaintext passwords from stolen configuration files, especially when combined with common password-cracking techniques.

Defenders told to assume credential exposure

Researchers are urging organizations to assume that credentials contained in exposed FortiGate configuration files have been compromised. Immediate actions include rotating all affected administrative and VPN passwords, enforcing multi-factor authentication (MFA), restricting internet access to management interfaces, and reviewing devices for signs of unauthorized access. Upgrading to supported FortiOS versions and replacing weaker or reused passwords is also critical. After upgrading, administrators should log in at least once to ensure passwords are converted to PBKDF2 hashing. Admin passwords can also be manually updated using a super_admin account.

Fortinet has not yet responded to requests for comment. The campaign highlights the ongoing risks associated with legacy security configurations and the importance of proactive credential management. Organizations using Fortinet devices should conduct thorough audits of their firewall configurations and ensure all administrator accounts have strong, unique passwords. The FortiBleed campaign serves as a stark reminder that credential harvesting remains a highly effective attack vector, especially when combined with automated tools and weak hashing algorithms.

The broader implications of this campaign extend beyond the immediate compromise. As attackers continue to refine their techniques, the line between targeted attacks and opportunistic harvesting blurs. The FortiBleed dataset, if fully exploited, could provide threat actors with a roadmap to some of the world's most sensitive networks. Researchers emphasize that even patched vulnerabilities can lead to long-term exposure if configuration files and credentials are not properly managed. The campaign underscores the need for continuous monitoring, regular credential rotation, and the adoption of modern authentication mechanisms across all enterprise devices.

Source:Network World News