FortiBleed campaign exposes credentials from 70,000+ Fortinet FortiGate firewalls; CISA warns of Windows domain takeovers
A credential-theft campaign called FortiBleed has exposed working administrator and VPN logins from more than 70,000 internet-facing Fortinet $FTNT FortiGate firewalls across 194 countries, by some estimates roughly half of all FortiGate devices reachable from the internet. CISA
FortiBleed: researchers report a large credential-theft campaign that exposed working logins from more than 70,000 internet-facing Fortinet $FTNT FortiGate firewalls across 194 countries. Attackers scan for exposed devices, try lists of known passwords, and turn each compromised firewall into a listening post that harvests fresh VPN credentials, feeding the next wave of break-ins. On June 18, CISA warned attackers are using the stolen credentials to move into corporate networks and seize Windows domains, and urged organizations to reset credentials and harden internet-facing Fortinet devices.