FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials
-
The FBI and the U.S. Secret Service have issued a joint warning that the FortiBleed credential harvesting campaign is still an active threat. The campaign targets internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, and it has already amassed 86,644 sets of stolen Fortinet device credentials.
According to the advisory, the attackers take advantage of two main weaknesses:
- Reused or previously leaked credentials
- Legacy SHA-256 password storage on affected devices
This combination allows the campaign to compromise Fortinet appliances that are exposed to the internet. Since the credentials were harvested through a mix of credential reuse and weak legacy hashing, simply changing passwords may not be enough if the same credentials are still in use elsewhere.
The FBI and Secret Service stress that FortiBleed remains active, meaning organizations running FortiGate firewalls or SSL VPN gateways should treat this as an ongoing risk rather than a contained incident. The warning comes as a reminder that internet-facing network edge devices continue to be a prime target for credential-based attacks.
Administrators should review their Fortinet deployments for exposed management interfaces, enforce credential hygiene, and verify that password storage mechanisms are not relying on outdated hashing.
Source: The Hacker News
Does your organization run FortiGate or SSL VPN appliances, and have you checked whether any of your credentials appear in past leaks?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login