The 'FortiBleed' campaign targeted approximately 74,000 internet-facing Fortinet FortiGate firewalls across 194 countries. Threat actors exploited an open directory vulnerability or misconfiguration to extract configuration files containing authentication hashes. Utilizing a specialized 45-GPU cluster, attackers conducted an estimated 1.16 billion brute-force attempts to crack these hashes, gaining unauthorized administrator and SSL VPN access. This initial perimeter breach served as a gateway for lateral movement into internal enterprise networks, specifically targeting Active Directory (AD) for privilege escalation and full domain compromise.

• Incident Overview: Global FortiGate Compromise

  • Impacted an estimated 73,932 devices across 194 countries, representing a significant portion of internet-facing FortiGate deployments.
  • Primary targets included administrator credentials and SSL VPN access tokens.
  • Coordinated intelligence from Arctic Wolf, CISA, and Cloudsek identified the campaign as a systematic, industrial-scale operation.

• Attack Vector: Configuration Extraction

  • Exploited "open directory" vulnerabilities or critical misconfigurations on internet-facing units to leak system files.
  • Focused on extracting configuration files containing stored authentication hashes for offline analysis.
  • Bypassed active perimeter defenses by shifting the attack surface from live authentication attempts to offline decryption.

• Threat Actor Infrastructure: High-Performance Cracking

  • Deployed a dedicated 45-GPU cluster to facilitate large-scale hash decryption.
  • Executed approximately 1.16 billion brute-force attempts to verify stolen credentials.
  • Attributed by investigators to a sophisticated, likely Russian-speaking threat group.

• Post-Exploitation: Lateral Movement & AD Escalation

  • Leveraged cracked SSL VPN and admin credentials to establish authorized entry into protected networks.
  • Utilized the FortiGate gateway as a pivot point to move laterally into internal environments.
  • Specifically targeted Active Directory (AD) environments to escalate privileges and expand the foothold within the enterprise.

• Defensive Actions: Mitigation & Hardening

  • Immediate audit of all internet-facing FortiGate devices for open directory exposures and unauthorized configuration access.
  • Mandatory reset of all administrator and SSL VPN passwords to invalidate leaked credentials.
  • Enforcement of Multi-Factor Authentication (MFA) across all remote access points to mitigate the risk of credential reuse.