Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

FortiBleed hijacks 30,000+ Fortinet devices across 194 countries

Part of the FortiBleed story · since 18 Jun

Quiet for 19 weekslast report 24 Jun19 articles9 outlets
18 Jun · SecurityOnline first28 Aug21 SepNowThis article1st of 19
  • Thu 18 Jun, 02:30 UTC. SecurityOnline, first report. FortiBleed hijacks 30,000+ Fortinet devices across 194 countries. This article, 1st of 19.
  • Thu 18 Jun, 07:01 UTC. SOCRadar, its first report on the story. SOCRadar Launches Free FortiBleed Exposure Checker and Publishes the Most Extensive Dataset on the Fortinet Credential Leak.
  • Thu 18 Jun, 08:10 UTC. Security Affairs, its first report on the story. FortiBleed leak exposes 75k Fortinet admin passwords online.
  • Thu 18 Jun, 12:50 UTC. DataBreaches, its first report on the story. FortiBleed exposes 75,000 FortiGate firewalls to credential theft.
  • Fri 19 Jun, 11:10 UTC. SecurityWeek, its first report on the story. CISA urges action after FortiBleed hits 86k firewalls.
  • Fri 19 Jun, 14:01 UTC. SOCRadar. FortiBleed Reveals Credential Reuse Threat to Fortinet Devices.
  • Fri 19 Jun, 15:06 UTC. The Hacker News, its first report on the story. FortiBleed flaw exposes 86,000 FortiGate devices, CISA warns.
  • Sat 20 Jun, 02:20 UTC. Unit 42, its first report on the story. FortiBleed campaign hits Fortinet devices with password spraying.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. FortiBleed attack targets FortiGate SSL VPN worldwide.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. CISA warns of FortiBleed credential leak exposing 74,000 devices.
  • Sun 21 Jun, 18:31 UTC. Security Affairs. FortiBleed Spray Hits Thousands Amid WordPress Malware Surge.
  • Mon 22 Jun, 08:40 UTC. Infosecurity, its first report on the story. NCSC urges Fortinet users to act after FortiBleed leak.
  • Mon 22 Jun, 08:41 UTC. SOCRadar. Alleged FortiBleed Access Auction, Sens Unique Paris Data Sale, and libsodium DoS Claims.
  • Mon 22 Jun, 09:50 UTC. SecurityWeek. Fortinet Alerts Users to Massive Credential Harvesting Campaign.
  • Mon 22 Jun, 11:30 UTC. Security Affairs. Russian hackers steal 110M credentials from 430k FortiGate devices.
  • Tue 23 Jun, 10:32 UTC. SecurityWeek. IAB hijacks 430k FortiGate firewalls in FortiBleed credential grab.
  • Tue 23 Jun, 13:32 UTC. Dark Reading, its first report on the story. FortiBleed hits 430k firewalls, stealing 110m credentials.
  • Tue 23 Jun, 20:10 UTC. The Hacker News. FortiBleed steals 110m credentials from FortiGate firewalls.
  • Wed 24 Jun, 10:31 UTC. Security Affairs. 73,000 Fortinet Firewall Credentials Exposed in Access Broker Leak.

The FortiBleed campaign has compromised 30,791 Fortinet firewalls and VPN credentials worldwide, affecting organizations across 194 countries, including banks, hospitals, and telecommunications companies. Identified by SOCRadar, the operation involves automated scanning and credential harvesting, utilizing a list of previously leaked passwords. This self-perpetuating system allows attackers to continually exploit breached devices. No new vulnerabilities are involved; rather, it's a matter of credential reuse.

SOCRadar has urged immediate action, recommending that organizations change passwords, enable two-factor authentication, and maintain up-to-date security measures.

How the story developed

All 19 articles
Quiet for 19 weekslast report 24 Jun19 articles9 outlets

19 articles from 9 outlets since 18 Jun. Quiet since 24 Jun. This was the first report.

Now18 Jun19202122232425261 NovFirst reportSecurityOnline · 18 Jun, 02:30
  • Thu 18 Jun, 02:30 UTC. SecurityOnline, first report. FortiBleed hijacks 30,000+ Fortinet devices across 194 countries. This article, 1st of 19.
  • Thu 18 Jun, 07:01 UTC. SOCRadar, its first report on the story. SOCRadar Launches Free FortiBleed Exposure Checker and Publishes the Most Extensive Dataset on the Fortinet Credential Leak.
  • Thu 18 Jun, 08:10 UTC. Security Affairs, its first report on the story. FortiBleed leak exposes 75k Fortinet admin passwords online.
  • Thu 18 Jun, 12:50 UTC. DataBreaches, its first report on the story. FortiBleed exposes 75,000 FortiGate firewalls to credential theft.
  • Fri 19 Jun, 11:10 UTC. SecurityWeek, its first report on the story. CISA urges action after FortiBleed hits 86k firewalls.
  • Fri 19 Jun, 14:01 UTC. SOCRadar. FortiBleed Reveals Credential Reuse Threat to Fortinet Devices.
  • Fri 19 Jun, 15:06 UTC. The Hacker News, its first report on the story. FortiBleed flaw exposes 86,000 FortiGate devices, CISA warns.
  • Sat 20 Jun, 02:20 UTC. Unit 42, its first report on the story. FortiBleed campaign hits Fortinet devices with password spraying.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. FortiBleed attack targets FortiGate SSL VPN worldwide.
  • Sat 20 Jun, 09:31 UTC. Security Affairs. CISA warns of FortiBleed credential leak exposing 74,000 devices.
  • Sun 21 Jun, 18:31 UTC. Security Affairs. FortiBleed Spray Hits Thousands Amid WordPress Malware Surge.
  • Mon 22 Jun, 08:40 UTC. Infosecurity, its first report on the story. NCSC urges Fortinet users to act after FortiBleed leak.
  • Mon 22 Jun, 08:41 UTC. SOCRadar. Alleged FortiBleed Access Auction, Sens Unique Paris Data Sale, and libsodium DoS Claims.
  • Mon 22 Jun, 09:50 UTC. SecurityWeek. Fortinet Alerts Users to Massive Credential Harvesting Campaign.
  • Mon 22 Jun, 11:30 UTC. Security Affairs. Russian hackers steal 110M credentials from 430k FortiGate devices.
  • Tue 23 Jun, 10:32 UTC. SecurityWeek. IAB hijacks 430k FortiGate firewalls in FortiBleed credential grab.
  • Tue 23 Jun, 13:32 UTC. Dark Reading, its first report on the story. FortiBleed hits 430k firewalls, stealing 110m credentials.
  • Tue 23 Jun, 20:10 UTC. The Hacker News. FortiBleed steals 110m credentials from FortiGate firewalls.
  • Wed 24 Jun, 10:31 UTC. Security Affairs. 73,000 Fortinet Firewall Credentials Exposed in Access Broker Leak.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 19 articles as a list
  1. Thu 18 JunDay 04
    1. FortiBleed hijacks 30,000+ Fortinet devices across 194 countries02:30 · SecurityOnline · First report · This article, 1st of 19
    2. SOCRadar Launches Free FortiBleed Exposure Checker and Publishes the Most Extensive Dataset on the Fortinet Credential Leak07:01 · SOCRadar
    3. FortiBleed leak exposes 75k Fortinet admin passwords online08:10 · Security Affairs
    4. FortiBleed exposes 75,000 FortiGate firewalls to credential theft12:50 · DataBreaches
  2. Fri 19 JunDay 13
    1. CISA urges action after FortiBleed hits 86k firewalls11:10 · SecurityWeek
    2. FortiBleed Reveals Credential Reuse Threat to Fortinet Devices14:01 · SOCRadar
    3. FortiBleed flaw exposes 86,000 FortiGate devices, CISA warns15:06 · The Hacker News
  3. Sat 20 JunDay 23
    1. FortiBleed campaign hits Fortinet devices with password spraying02:20 · Unit 42
    2. FortiBleed attack targets FortiGate SSL VPN worldwide09:31 · Security Affairs
    3. CISA warns of FortiBleed credential leak exposing 74,000 devices09:31 · Security Affairs
  4. Sun 21 JunDay 31
    1. FortiBleed Spray Hits Thousands Amid WordPress Malware Surge18:31 · Security Affairs
  5. Mon 22 JunDay 44
    1. NCSC urges Fortinet users to act after FortiBleed leak08:40 · Infosecurity
    2. Alleged FortiBleed Access Auction, Sens Unique Paris Data Sale, and libsodium DoS Claims08:41 · SOCRadar
    3. Fortinet Alerts Users to Massive Credential Harvesting Campaign09:50 · SecurityWeek
    4. Russian hackers steal 110M credentials from 430k FortiGate devices11:30 · Security Affairs
  6. Tue 23 JunDay 53
    1. IAB hijacks 430k FortiGate firewalls in FortiBleed credential grab10:32 · SecurityWeek
    2. FortiBleed hits 430k firewalls, stealing 110m credentials13:32 · Dark Reading
    3. FortiBleed steals 110m credentials from FortiGate firewalls20:10 · The Hacker News
  7. Wed 24 JunDay 61
    1. 73,000 Fortinet Firewall Credentials Exposed in Access Broker Leak10:31 · Security Affairs

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in