FBI: FortiBleed attacks are still locking admins out of FortiGate VPNs
If you run FortiGate, the FBI's remediation list is the part to read.
The FBI warns that attacks using the FortiBleed credentials leak are ongoing against exposed Fortinet FortiGate firewalls and SSL VPN gateways. Attackers log in with leaked or stolen credentials, crack further password hashes offline, and in some cases create their own admin accounts and delete or change the legitimate ones. The FBI says the attack chain has been an entry point for ransomware affiliates. It says fixing this may take more than patching and resetting passwords: restrict external access, end all active VPN sessions, enforce MFA and review logs.
-
Credential stuffing
After exploring FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins, the attack pattern underneath is Credential stuffing.
Attackers take lists of stolen usernames and passwords and automate logins against other systems. Unlike brute force, it doesn't guess passwords; it reuses ones that already leaked.
Wikipedia · Wade · 5 min
0