A firewall has exactly one job: stand at the door and tell strangers to get lost. So there is something darkly poetic about an attack campaign that turned roughly half the internet's Fortinet doormen into informants — handing over the guest list, the keys, and the floor plan.
86,000 Credentials, 194 Countries
Security researchers disclosed FortiBleed this month, a sprawling credential-compromise campaign aimed at Fortinet FortiGate firewalls and SSL VPN gateways. The operation produced a verified database of more than 86,000 working credentials spanning 194 countries — pulled from internet-facing Fortinet gear that, by some estimates, accounts for roughly half of all such devices reachable online.
The mechanics are grimly industrial. Attackers hammered targets with an estimated 1.16 billion credential attempts across more than 320,000 FortiGate devices, then, once inside, deployed a custom credential-harvesting sniffer dubbed FortigateSniffer. Stolen hashes were cracked offline on a 45-GPU cluster orchestrated with Hashtopolis, and the working logins became springboards into internal Active Directory environments.
The Edge Device Is the New Soft Target
FortiBleed is a blunt reminder that the security appliance is now the prize, not the protection. VPN gateways and firewalls sit directly on the internet, run privileged code, and are too often patched on a 'we will get to it' schedule — which makes them the perfect beachhead. Compromise the guard, and you skip every interior lock.
On June 18, CISA urged Fortinet customers to act as if they were already breached: terminate all active SSL VPN and administrative sessions, reset every VPN and admin password, and stop trusting any credential that might have crossed one of these boxes. That 'assume compromise' posture is no longer paranoia — it is just Tuesday.
The uncomfortable lesson is that your perimeter is only as trustworthy as its last credential reset. If a single internet-facing appliance still carries the password it shipped with a year ago, you do not have a firewall — you have a very expensive welcome mat. Change the locks, then change them again.
Source: BleepingComputer