Attackers Exploit Fortinet Flaw to Lock Out Admins via Account Manipulation
Threat actors are abusing a Fortinet vulnerability to delete legitimate administrator accounts and passwords, effectively locking victims out of their security devices.
Key points
- Attackers are creating new accounts and deleting existing ones on compromised Fortinet devices.
- The goal is to prevent legitimate administrators from accessing their systems.
- This activity is linked to the FortiBleed vulnerability in Fortinet products.
Cybercriminals are actively exploiting a vulnerability in Fortinet devices to seize control and permanently lock out legitimate administrators. According to a report by SecurityWeek, attackers are deleting existing user accounts and passwords while creating new ones, a tactic designed to deny authorized personnel access to their security infrastructure.
The malicious activity centers on the FortiBleed vulnerability. By manipulating account structures, threat actors ensure that original administrators cannot log in to remediate the breach or restore system integrity. This lockout strategy effectively hands complete control of the network perimeter devices to the attackers, who can then persist within the environment or pivot to other targets. The report highlights that the deletion of credentials is not merely destructive but serves as a persistent access control mechanism for the intruders.
Context and Background
The FortiBleed vulnerability has been a significant concern for the cybersecurity community due to its potential to expose sensitive data and allow for unauthorized command execution. The latest developments reported by SecurityWeek indicate that threat actors are moving beyond simple data exfiltration or initial access. Instead, they are employing account manipulation techniques to solidify their foothold.
By creating new accounts, attackers establish backdoors that remain functional even if the original system configuration is partially restored. Simultaneously, the deletion of existing accounts and passwords removes the primary defense mechanism for administrators: their login credentials. This dual approach of addition and deletion makes recovery difficult without external intervention or physical access to the device, assuming such access is available and secure.
Who Is Affected
Organizations relying on Fortinet hardware for their network security are the primary targets of this specific attack vector. The impact is most severe for environments where Fortinet devices serve as critical gateways or firewalls. If an attacker successfully executes this account-lockout routine, the affected organization loses visibility and control over its traffic filtering and security policies.
The report from SecurityWeek does not specify the exact number of victims or the geographic distribution of the attacks. However, the nature of the exploit suggests that any unpatched or vulnerable Fortinet device exposed to the internet is at risk. The severity of the situation is compounded by the fact that the attackers are not just stealing data but are actively disabling the ability of security teams to respond.
What should you do?
Security teams should immediately audit their Fortinet device logs for signs of unauthorized account creation or deletion. Administrators should verify the integrity of all user accounts, particularly those with administrative privileges. If suspicious activity is detected, isolating the affected device from the network is recommended to prevent further lateral movement. Organizations should also review their incident response plans to ensure they have procedures for recovering access to locked-out security devices.
What to do and how to stay safe: Fortinet
- Review administrative logs on Fortinet devices for unauthorized account creation or deletion events.
- Verify the integrity of all user accounts and reset passwords for any accounts that show unexpected changes.
- Isolate compromised Fortinet devices from the network to prevent attackers from maintaining access or pivoting.
- Monitor for new, unknown accounts appearing on your security appliances and investigate their origin immediately.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What are attackers doing with Fortinet devices?
Attackers are creating new accounts and deleting existing ones and passwords to prevent legitimate access to Fortinet devices.
What is the name of the vulnerability being exploited?
The activity is linked to the FortiBleed vulnerability.
What is the main goal of this attack method?
The main goal is to lock out legitimate administrators by removing their credentials and creating new access points for the attackers.
