Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations using Fortinet FortiGate firewalls and SSL VPN gateways
Incident: A large-scale credential harvesting campaign targeting internet-facing Fortinet devices.
Impact: Full administrative takeover of network gateways leading to lateral movement and sensitive data exfiltration.
Attacker: Russian-speaking threat actors
Analysis: The FortiBleed campaign utilizes a combination of credential stuffing and a specialized Go-based tool, FortigateSniffer, to capture authentication traffic. Once captured, password hashes are processed through GPU-accelerated cracking clusters to facilitate lateral movement and data exfiltration. The operation specifically targets legacy password storage methods and internet-facing gateways to gain deep network access.
Recommendations: Implement phishing-resistant multi-factor authentication (MFA) for all VPN and administrative access.; Upgrade password storage to the PBKDF2 algorithm to prevent rapid offline cracking.; Perform a comprehensive password reset for all administrative and VPN accounts and terminate all active sessions.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source