FortiBleed Is Still Active, FBI and Secret Service Warn: Your Questions Answered
A new FBI and Secret Service alert says the FortiBleed credential campaign against Fortinet firewalls and VPN gateways is ongoing, can lock real owners out, and is feeding ransomware crews.
Federal investigators are telling Fortinet customers not to treat FortiBleed as yesterday’s problem. A joint alert from the FBI and the U.S. Secret Service, released Tuesday, October 6, describes the campaign as active and increasingly tied to ransomware. Below are the questions business owners are asking, with answers drawn from the reporting.
What exactly is FortiBleed?
It is a credential-compromise campaign aimed at Fortinet firewalls and VPN gateways. It first came to light earlier this year. Attackers use stolen credentials to get into exposed devices, and once inside they can add new administrator accounts.
Why is this alert different from a normal patch notice?
Because patching alone may not undo the damage. The agencies warn that intruders can disable accounts or change passwords, which can shut legitimate administrators out of their own equipment. In that situation, the alert says, recovery takes more than the usual patch-and-reset routine.
How many devices are involved?
Counts vary depending on how they are measured. When the campaign was first uncovered, threat intelligence firm SOCRadar verified more than 86,644 compromised devices across 194 countries. SOCRadar’s CISO, Ensar Seker, said later investigation identified roughly 400,000 to 450,000 firewalls targeted by the wider operation, and that the picture is broader and more serious than first understood.
Where does ransomware come in?
The alert says FortiBleed has been seen as an initial entry point for ransomware affiliates. Initial access brokers are reportedly using the access to supply ransomware groups, including INC/Lynx and Payload.
What do the FBI and Secret Service recommend?
- Restrict external management of Fortinet devices, or remove internet-facing administration entirely.
- Reset credentials.
- Turn on multifactor authentication.
- Review firewall and VPN user lists for unauthorized changes.
- Check logs for signs of lateral movement.
- Enable secure credential storage.
Are the agencies asking victims for anything?
Yes. They want organizations to share indicators of compromise, including attacker IP addresses and any usernames the intruders created or used.
For the full story, see Tim Starks’ coverage of the joint alert at CyberScoop.
What this means for your company
- Know what sits at your edge. If a Fortinet firewall or VPN protects your office or remote staff, confirm who manages it and whether its admin interface is reachable from the internet.
- Audit the admin list, not just the firmware. Look for administrator or VPN accounts nobody recognizes. A device can be fully patched and still be compromised.
- Plan for a lockout. Keep an offline record of how to regain control of your firewall, and make sure more than one trusted person can do it.
- Treat edge alerts as ransomware warnings. Unusual VPN logins should trigger a check of servers and backups, not just a password change.
Need help checking your firewall and VPN for FortiBleed-style tampering? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
