According to the advisory, the attackers take advantage of two main weaknesses:

• Reused or previously leaked credentials
• Legacy SHA-256 password storage on affected devices

This combination allows the campaign to compromise Fortinet appliances that are exposed to the internet. Since the credentials were harvested through a mix of credential reuse and weak legacy hashing, simply changing passwords may not be enough if the same credentials are still in use elsewhere.

The FBI and Secret Service stress that FortiBleed remains active, meaning organizations running FortiGate firewalls or SSL VPN gateways should treat this as an ongoing risk rather than a contained incident. The warning comes as a reminder that internet-facing network edge devices continue to be a prime target for credential-based attacks.

Administrators should review their Fortinet deployments for exposed management interfaces, enforce credential hygiene, and verify that password storage mechanisms are not relying on outdated hashing.

Source: The Hacker News

Does your organization run FortiGate or SSL VPN appliances, and have you checked whether any of your credentials appear in past leaks?