Analysis of Reported Credential Compromise of FortiGate Devices

Situational Analysis

Fortinet is aware of reports of malicious cyber actors targeting Fortinet devices in a credential-harvesting campaign referred to as FortiBleed. Based on our initial analysis, we believe the activity involves threat actors reusing credentials from previous incidents (FG-IR-26-060, FG-IR-25-647) and employing brute-force techniques (as described in a March blog, “Attacks at the Speed of AI”) against devices with weak password hygiene and no multi-factor authentication (MFA).

Fortinet provided detailed guidance at the time of these advisories and we continue to strongly encourage all customers to ensure these remediation steps have been completed.

This is not a new Fortinet vulnerability, and this activity is not related to any recent incident or advisory.

Upon identifying the incident, we immediately began an investigation, including collaborating with relevant government agencies.

Was My Organization Affected?

Fortinet’s culture of proactive, transparent, and responsible product security disclosure is one of the many ways we show up as a responsible member of a larger cybersecurity ecosystem and demonstrate our commitment to helping customers make informed, risk-based decisions.

Fortinet has identified the potentially compromised systems, and we are proactively contacting impacted customers. To defend against this malicious cyber activity, Fortinet recommends that customers with impacted FortiGate appliances to immediately:

1. Terminate all admin and VPN sessions and reset credentials. Terminate all active administrative sessions. Reset all Fortinet VPN and administrative passwords, especially on internet-facing systems, and enforce strong password policies.
2. Implement MFA on all administrator and VPN user accounts.
3. Upgrade to latest versions of 7.4, 7.6, or 8.0.  These versions support PBKDF2 hashing of administrator credentials. Follow the guidance to remove older legacy password settings via set login-lockout-upon-weaker-encryption.
4. Validate configuration. Review firewall and VPN users and other configuration for unauthorized changes.  Preferably compare to a known good configuration.  Pay particular attention to the addition of unrecognized accounts, such as “forticloud, fortiuser, fortinet-support, fortinet-tech-support,” etc.
5. Check your logs. Look for unexpected administrator access from an unknown IP and domain controller logs for lateral movement, unusual access, suspicious accounts, or unauthorized configuration changes.
6. Reduce your attack surface and lock down management access. Restrict external management of your devices via trusted hosts (good), a local-in policy (better), or remove internet administration altogether (best).

Additional security best practices for administrator access and general hardening can be found in the Best Practices Guides.

If there is any evidence of unapproved modification of the configuration or other IoCs:

• Treat the devices as compromised and follow the guidance here to recover.
• Check for the creation of VPN users, unexpected password resets, or VPN from unexpected locations, which may indicate the actor has attempted lateral movement into the internal network.
• If AD/LDAP integration is configured, it is important to treat this account as compromised and monitor your AD for its use for authentication elsewhere or the creation of additional accounts and monitor your network for lateral movement.

If you believe your internal network may have been compromised, please contact Fortinet support.

Fortinet diligently balances our commitment to the security of our customers and our culture of responsible transparency. We are continuing to investigate this situation and taking actionable steps with the security of our customers as our top priority. Our response and mitigation efforts remain ongoing.