FBI Warns FortiBleed Campaign Continues to Harvest Fortinet Credentials
Law enforcement agencies report that the FortiBleed credential harvesting campaign remains active, targeting internet-facing Fortinet devices and exploiting legacy password storage methods.
Key points
- The FBI and U.S. Secret Service warn that the FortiBleed campaign is still active.
- Threat actors have amassed over 86,000 credentials from Fortinet devices.
- The attack exploits reused passwords and legacy SHA-256 storage mechanisms.
The U.S. Federal Bureau of Investigation (FBI) and the U.S. Secret Service (USSS) issued a warning on Tuesday stating that the FortiBleed credential harvesting campaign remains an active threat. According to The Hacker News, law enforcement agencies are alerting organizations that attackers continue to target internet-facing Fortinet FortiGate firewalls and secure socket layer (SSL) virtual private network (VPN) gateways.
The campaign has proven persistent, with threat actors successfully amassing 86,644 Fortinet device credentials. The FBI and USSS note that the campaign exploits reused or leaked credentials alongside legacy SHA-256 password storage. This combination of weak authentication practices and outdated cryptographic methods allows attackers to bypass security controls and harvest valid login information from exposed infrastructure.
Context and Background
The FortiBleed campaign specifically targets the authentication mechanisms of Fortinet hardware. By leveraging the SHA-256 hashing algorithm used in legacy configurations, attackers can process harvested data to recover plaintext passwords. The scale of the credential harvest, exceeding 86,000 entries, indicates a widespread and automated effort to compromise network perimeters.
According to The Hacker News, the warning from federal agencies highlights the ongoing risk posed by internet-facing devices that have not been properly hardened. The use of SSL VPN gateways as entry points is a common tactic in this campaign, as these services often require robust authentication that may be undermined by poor password hygiene or outdated system configurations.
Who Is Affected
Organizations utilizing Fortinet FortiGate firewalls and SSL VPN gateways are the primary targets of this campaign. The threat is most acute for devices that are directly exposed to the internet. Entities that rely on reused passwords or have not migrated away from legacy SHA-256 password storage are at elevated risk.
The FBI and USSS warning applies to any entity maintaining these specific Fortinet products in their network infrastructure. The active nature of the campaign means that current exposure is possible even if previous security audits were conducted, particularly if those audits did not address the specific vectors of credential reuse and legacy hashing methods.
What should you do?
Security teams should immediately review their Fortinet device configurations for internet exposure. Organizations must assess whether their current password storage methods rely on legacy SHA-256 implementations. Monitoring for unauthorized access attempts on SSL VPN gateways is critical, as these are primary targets for the FortiBleed campaign.
What to do and how to stay safe: Fortinet
- Audit all internet-facing Fortinet FortiGate firewalls and SSL VPN gateways for unauthorized access indicators.
- Enforce strict password policies to eliminate credential reuse across all network devices and user accounts.
- Verify that password storage configurations do not rely on legacy SHA-256 methods, upgrading to more secure standards where possible.
- Monitor logs for anomalous authentication attempts that may indicate active credential harvesting efforts.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the FortiBleed campaign?
FortiBleed is an active credential harvesting campaign targeting Fortinet FortiGate firewalls and SSL VPN gateways, exploiting reused credentials and legacy SHA-256 password storage.
How many credentials have been compromised?
Threat actors have amassed 86,644 Fortinet device credentials through this campaign, according to the FBI and USSS warning reported by The Hacker News.
Is there a patch available for this vulnerability?
The source material does not confirm the availability of a specific patch or fix for the FortiBleed campaign; it highlights the exploitation of configuration weaknesses like reused credentials and legacy storage.
