Skip to content
OriginalSign in
Image: SOCRadar

SOCRadarYağmur Ernalbant

FortiBleed Reveals Credential Reuse Threat to Fortinet Devices

Part of the FortiBleed story · since 18 Jun

Quiet for 17 weekslast report 2 Jul23 articles9 outlets
18 Jun · SecurityOnline first28 Aug21 SepNowThis article6th of 23
  • Thu 18 Jun, 02:30 UTC. SecurityOnline, first report. FortiBleed hijacks 30,000+ Fortinet devices across 194 countries.
  • Thu 18 Jun, 07:01 UTC. SOCRadar, its first report on the story. SOCRadar Launches Free FortiBleed Exposure Checker and Publishes the Most Extensive Dataset on the Fortinet Credential Leak.
  • Thu 18 Jun, 08:10 UTC. Security Affairs, its first report on the story. FortiBleed leak exposes 75k Fortinet admin passwords online.
  • Thu 18 Jun, 12:50 UTC. DataBreaches, its first report on the story. FortiBleed exposes 75,000 FortiGate firewalls to credential theft.
  • Fri 19 Jun, 11:10 UTC. SecurityWeek, its first report on the story. CISA urges action after FortiBleed hits 86k firewalls.
  • Fri 19 Jun, 14:01 UTC. SOCRadar. FortiBleed Reveals Credential Reuse Threat to Fortinet Devices. This article, 6th of 23.
  • Fri 19 Jun, 15:06 UTC. The Hacker News, its first report on the story. FortiBleed flaw exposes 86,000 FortiGate devices, CISA warns.
  • Sat 20 Jun, 02:20 UTC. Unit 42, its first report on the story. FortiBleed campaign hits Fortinet devices with password spraying.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. FortiBleed attack targets FortiGate SSL VPN worldwide.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. CISA warns of FortiBleed credential leak exposing 74,000 devices.
  • Sun 21 Jun, 18:31 UTC. Security Affairs. FortiBleed Spray Hits Thousands Amid WordPress Malware Surge.
  • Mon 22 Jun, 08:40 UTC. Infosecurity, its first report on the story. NCSC urges Fortinet users to act after FortiBleed leak.
  • Mon 22 Jun, 08:41 UTC. SOCRadar. Alleged FortiBleed Access Auction, Sens Unique Paris Data Sale, and libsodium DoS Claims.
  • Mon 22 Jun, 09:50 UTC. SecurityWeek. Fortinet Alerts Users to Massive Credential Harvesting Campaign.
  • Mon 22 Jun, 11:30 UTC. Security Affairs. Russian hackers steal 110M credentials from 430k FortiGate devices.
  • Tue 23 Jun, 10:32 UTC. SecurityWeek. IAB hijacks 430k FortiGate firewalls in FortiBleed credential grab.
  • Tue 23 Jun, 13:32 UTC. Dark Reading, its first report on the story. FortiBleed hits 430k firewalls, stealing 110m credentials.
  • Tue 23 Jun, 20:10 UTC. The Hacker News. FortiBleed steals 110m credentials from FortiGate firewalls.
  • Wed 24 Jun, 10:31 UTC. Security Affairs. 73,000 Fortinet Firewall Credentials Exposed in Access Broker Leak.
  • Thu 2 Jul, 09:21 UTC. The Hacker News. FortiBleed Credential Theft Fuels INC and Lynx Ransomware Surge.
  • Thu 2 Jul, 11:11 UTC. Security Affairs. FortiBleed Campaign Fuels Ransomware on 430k FortiGate Devices.
  • Thu 2 Jul, 13:01 UTC. SecurityWeek. FortiBleed Exploits FortiGate, Triggers Worldwide Ransomware Wave.
  • Thu 2 Jul, 20:12 UTC. Dark Reading. FortiBleed breach fuels ransomware risk for Inc and Lynx gangs.

The article discusses FortiBleed, a large-scale credential theft campaign targeting Fortinet devices, particularly FortiGate firewalls and SSL VPN gateways. The operation is driven by credential reuse, using stolen credentials from previous breaches. SOCRadar estimates over 86,644 Fortinet devices in 194 countries are compromised, with attackers exploiting poor operational security practices rather than software vulnerabilities.

Organizations are advised to change passwords immediately, enable multi-factor authentication, and limit internet exposure of management interfaces. The article also highlights ongoing monitoring for any potential sales of the stolen credentials on the Dark Web.

How the story developed

All 23 articles
Quiet for 17 weekslast report 2 Jul23 articles9 outlets

23 articles from 9 outlets since 18 Jun. Quiet since 2 Jul. This was the 6th report, 1 day after the first.

Now18 Jun20222426283024First reportSecurityOnline · 18 Jun, 02:30This article6th of 23 · day 1Picked up againafter 8 days quiet
  • Thu 18 Jun, 02:30 UTC. SecurityOnline, first report. FortiBleed hijacks 30,000+ Fortinet devices across 194 countries.
  • Thu 18 Jun, 07:01 UTC. SOCRadar, its first report on the story. SOCRadar Launches Free FortiBleed Exposure Checker and Publishes the Most Extensive Dataset on the Fortinet Credential Leak.
  • Thu 18 Jun, 08:10 UTC. Security Affairs, its first report on the story. FortiBleed leak exposes 75k Fortinet admin passwords online.
  • Thu 18 Jun, 12:50 UTC. DataBreaches, its first report on the story. FortiBleed exposes 75,000 FortiGate firewalls to credential theft.
  • Fri 19 Jun, 11:10 UTC. SecurityWeek, its first report on the story. CISA urges action after FortiBleed hits 86k firewalls.
  • Fri 19 Jun, 14:01 UTC. SOCRadar. FortiBleed Reveals Credential Reuse Threat to Fortinet Devices. This article, 6th of 23.
  • Fri 19 Jun, 15:06 UTC. The Hacker News, its first report on the story. FortiBleed flaw exposes 86,000 FortiGate devices, CISA warns.
  • Sat 20 Jun, 02:20 UTC. Unit 42, its first report on the story. FortiBleed campaign hits Fortinet devices with password spraying.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. FortiBleed attack targets FortiGate SSL VPN worldwide.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. CISA warns of FortiBleed credential leak exposing 74,000 devices.
  • Sun 21 Jun, 18:31 UTC. Security Affairs. FortiBleed Spray Hits Thousands Amid WordPress Malware Surge.
  • Mon 22 Jun, 08:40 UTC. Infosecurity, its first report on the story. NCSC urges Fortinet users to act after FortiBleed leak.
  • Mon 22 Jun, 08:41 UTC. SOCRadar. Alleged FortiBleed Access Auction, Sens Unique Paris Data Sale, and libsodium DoS Claims.
  • Mon 22 Jun, 09:50 UTC. SecurityWeek. Fortinet Alerts Users to Massive Credential Harvesting Campaign.
  • Mon 22 Jun, 11:30 UTC. Security Affairs. Russian hackers steal 110M credentials from 430k FortiGate devices.
  • Tue 23 Jun, 10:32 UTC. SecurityWeek. IAB hijacks 430k FortiGate firewalls in FortiBleed credential grab.
  • Tue 23 Jun, 13:32 UTC. Dark Reading, its first report on the story. FortiBleed hits 430k firewalls, stealing 110m credentials.
  • Tue 23 Jun, 20:10 UTC. The Hacker News. FortiBleed steals 110m credentials from FortiGate firewalls.
  • Wed 24 Jun, 10:31 UTC. Security Affairs. 73,000 Fortinet Firewall Credentials Exposed in Access Broker Leak.
  • Thu 2 Jul, 09:21 UTC. The Hacker News. FortiBleed Credential Theft Fuels INC and Lynx Ransomware Surge.
  • Thu 2 Jul, 11:11 UTC. Security Affairs. FortiBleed Campaign Fuels Ransomware on 430k FortiGate Devices.
  • Thu 2 Jul, 13:01 UTC. SecurityWeek. FortiBleed Exploits FortiGate, Triggers Worldwide Ransomware Wave.
  • Thu 2 Jul, 20:12 UTC. Dark Reading. FortiBleed breach fuels ransomware risk for Inc and Lynx gangs.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 23 articles as a list
  1. Thu 18 JunDay 04
    1. FortiBleed hijacks 30,000+ Fortinet devices across 194 countries02:30 · SecurityOnline · First report
    2. SOCRadar Launches Free FortiBleed Exposure Checker and Publishes the Most Extensive Dataset on the Fortinet Credential Leak07:01 · SOCRadar
    3. FortiBleed leak exposes 75k Fortinet admin passwords online08:10 · Security Affairs
    4. FortiBleed exposes 75,000 FortiGate firewalls to credential theft12:50 · DataBreaches
  2. Fri 19 JunDay 13
    1. CISA urges action after FortiBleed hits 86k firewalls11:10 · SecurityWeek
    2. FortiBleed Reveals Credential Reuse Threat to Fortinet Devices14:01 · SOCRadar · This article, 6th of 23
    3. FortiBleed flaw exposes 86,000 FortiGate devices, CISA warns15:06 · The Hacker News
  3. Sat 20 JunDay 23
    1. FortiBleed campaign hits Fortinet devices with password spraying02:20 · Unit 42
    2. FortiBleed attack targets FortiGate SSL VPN worldwide09:31 · Security Affairs
    3. CISA warns of FortiBleed credential leak exposing 74,000 devices09:31 · Security Affairs
  4. Sun 21 JunDay 31
    1. FortiBleed Spray Hits Thousands Amid WordPress Malware Surge18:31 · Security Affairs
  5. Mon 22 JunDay 44
    1. NCSC urges Fortinet users to act after FortiBleed leak08:40 · Infosecurity
    2. Alleged FortiBleed Access Auction, Sens Unique Paris Data Sale, and libsodium DoS Claims08:41 · SOCRadar
    3. Fortinet Alerts Users to Massive Credential Harvesting Campaign09:50 · SecurityWeek
    4. Russian hackers steal 110M credentials from 430k FortiGate devices11:30 · Security Affairs
  6. Tue 23 JunDay 53
    1. IAB hijacks 430k FortiGate firewalls in FortiBleed credential grab10:32 · SecurityWeek
    2. FortiBleed hits 430k firewalls, stealing 110m credentials13:32 · Dark Reading
    3. FortiBleed steals 110m credentials from FortiGate firewalls20:10 · The Hacker News
  7. Wed 24 JunDay 61
    1. 73,000 Fortinet Firewall Credentials Exposed in Access Broker Leak10:31 · Security Affairs

  8. Quiet for 8 days

    Thu 2 JulDay 144
    1. FortiBleed Credential Theft Fuels INC and Lynx Ransomware Surge09:21 · The Hacker News · Picked up again
    2. FortiBleed Campaign Fuels Ransomware on 430k FortiGate Devices11:11 · Security Affairs
    3. FortiBleed Exploits FortiGate, Triggers Worldwide Ransomware Wave13:01 · SecurityWeek
    4. FortiBleed breach fuels ransomware risk for Inc and Lynx gangs20:12 · Dark Reading

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in