A massive credential-compromise campaign dubbed "FortiBleed" has been found to expose tens of thousands of Fortinet devices worldwide, with researchers warning of persistent attacker access to affected enterprise environments. The campaign, first flagged by security researcher Volodymyr Diachenko, centers on an attacker-controlled list of potentially working FortiGate passwords collected through various means. Further investigation by SOCRadar, Hudson Rock, and independent researcher Kevin Beaumont revealed the scope: approximately 75,000 internet-facing Fortinet firewalls — roughly half of all such devices visible on the Shodan search engine — have been compromised.

Discovery and attribution

Diachenko posted on LinkedIn about finding a list of stolen FortiGate passwords. SOCRadar later independently discovered an operational server belonging to an unnamed threat actor. That server contained a list of stolen FortiGate passwords, tools, automation infrastructure, a victim list, and telling information about who could be behind the attack. "Attribution is ongoing, but the operational fingerprints are clear," SOCRadar researchers said in a blog post, adding that the tooling and targeting choices are consistent with Russian-speaking threat actors.

According to independent analyses, including by SOCRadar, Hudson Rock, and Beaumont, the threat actors systematically collected configuration files from internet-facing Fortinet FortiGate firewalls and used them to recover working administrator credentials. The initial access vector is presently unknown, but Benjamin Harris, CEO of watchTowr, noted that the campaign is consistent with what he has been seeing lately. "The uncomfortable reality is that modern exploitation isn't always about immediate impact," he said. "It's about harvesting data that retains value long after the underlying vulnerability has been patched." These credentials were likely accumulated over time by exploiting many vulnerabilities affecting sensitive, externally facing Fortinet applications, he added.

Scale and global reach

While SOCRadar initially reported that the dataset contained working login credentials for over 30,791 devices, further analysis by Beaumont and Hudson Rock placed the affected devices at 75,000. Researchers found affected devices across 194 countries, spanning more than 21,000 domains. The dataset reportedly contains a mix of administrative and SSL VPN credentials recovered from compromised configuration files. Researchers said the operation is highly automated, allowing threat actors to collect, process, and crack credential material at a very large scale. SOCRadar found the top affected countries to be India, the US, and Mexico, with a little under 12,000 compromised credentials between them. A credential-type breakdown revealed organization-specific credentials to be most probed, indicating enterprise targeting.

Explaining the potential impact, Beaumont said the threat actors "can log in remotely and gain remote access to the firewall — and so the network." They can also change settings, including security controls, and make backdoor users, he added. This level of access could allow attackers to pivot deeper into an organization's internal systems, reconfigure firewall rules to allow malicious traffic, or exfiltrate sensitive data over VPN tunnels.

Old hashes, new problems

Additional investigation into the campaign highlighted why some Fortinet deployments proved easier to crack than others. Researchers noted that many affected systems stored administrator credentials using older hashing approaches that were significantly less resistant to offline password-cracking attacks than more recent implementations. Fortinet introduced PBKDF2-based password hashing for administrator credentials in FortiOS versions 7.2.11, 7.4.8, and 7.6.1, replacing the legacy SHA-256-based storage mechanism. However, when upgrading from earlier versions, existing administrator passwords remain stored as SHA-256 hashes until the corresponding administrator successfully logs in following the upgrade. This has led to many organizations continuing to store admin credentials using the older SHA-256 with salt hashing mechanism, which can be cracked far more quickly using GPU-based tools like hashcat.

The difference in security is stark. PBKDF2 is a key derivation function that applies a configurable number of iterations (Fortinet uses thousands), making brute-force and dictionary attacks computationally expensive. SHA-256, while still a strong hash, is designed for speed, meaning an attacker with a modern graphics card can test billions of password candidates per second. If the salt (a random value added to each password before hashing) is also exposed — which it is in FortiGate configuration files — the attacker has everything needed to crack passwords offline at high speed.

This has been a known issue in the Fortinet ecosystem for years. Security researchers have previously warned that many organizations fail to upgrade their firewall firmware in a timely manner, or do not enforce administrator password changes post-upgrade. The FortiBleed campaign appears to have capitalized on this gap.

Defenders told to assume credential exposure

Researchers urged organizations to assume that credentials contained in exposed FortiGate configuration files have been compromised and to immediately rotate affected administrative and VPN passwords. Additional recommendations include enforcing multi-factor authentication (MFA), restricting internet access to management interfaces, and reviewing devices for signs of unauthorized access. Upgrading to supported FortiOS versions and replacing weaker or reused passwords was also advised. "After upgrading FortiOS, require all administrators to log in to the firewall at least once: this will automatically set the encryption to PBKDF2," researchers said. Admin passwords can also be manually updated by using a super_admin account, they noted.

The broader implication of the FortiBleed campaign is a wake-up call for network security teams worldwide. Firewalls are often treated as the first line of defense, yet many organizations neglect to secure their configuration files or enforce strong password hashing. The use of default or weak administrative passwords remains a persistent problem, and attackers have repeatedly demonstrated that they are willing to harvest credentials at massive scale for later use.

Given the tens of thousands of affected devices and the likelihood that many have already been backdoored, organizations should conduct forensic audits of their FortiGate logs, looking for unauthorized administrative logins, unexpected configuration changes, or VPN sessions from unknown IP addresses. The threat actors behind FortiBleed are likely to continue leveraging stolen credentials long after the initial breach is discovered, especially if organizations fail to rotate passwords and enable multi-factor authentication.

Fortinet did not immediately respond to CSO's request for comment at the time of publication. But independent experts have already published detailed guidance on how to detect compromise and recover from the attack. The incident underscores that credential compromise remains one of the most effective — and underappreciated — attack vectors in modern cybersecurity, especially when combined with automated mass harvesting and offline cracking.

Source: Network World News