Organizations utilizing Fortinet firewalls and VPN gateways are being alerted to a global campaign that has targeted these devices. The National Cyber Security Centre (NCSC) in the UK has issued guidance for affected entities, urging them to investigate potential compromises and implement mitigation strategies.
The threat actor's activity involves brute-force, dictionary, and credential stuffing attacks aimed at internet-facing FortiGate devices and VPN portals. Credential stuffing, a common tactic, involves attackers using lists of usernames and passwords stolen from other services to attempt unauthorized access, exploiting password reuse practices.
A database of credentials has reportedly been leaked by the threat actor following these attempts. While the NCSC notes some indications of potential impact in the UK, the targeting appears to be global.
Organizations with Fortinet edge devices, particularly those with SSL VPN enabled, are advised to examine their systems for signs of malicious activity. This includes looking for unauthorized account creations and unusual entries in log files.
To assist in this investigation, two tools are recommended: SOCRadar's FortiBleed Checker and Hudson Rock's FortiBleed Checker. Users are encouraged to check these tools for any domains that may have been affected and to confirm ownership of any listed Fortinet devices.
If a compromise is detected, the immediate priority is to isolate the affected device from both the internet and the internal network. Fortinet has released a blog post detailing its analysis and providing guidance for customers.
Beyond isolation, a factory reset of the compromised device is recommended, as simply changing credentials may not be sufficient if the attackers have established persistence. Prior to resetting, it is crucial to collect logs, configurations, and other artifacts that could be valuable for forensic investigations.
The NCSC also stresses the importance of investigating other edge devices that share credentials with the compromised system, as well as monitoring firewall logs for suspicious activity to ensure no further lateral movement has occurred within the network.
Hardening measures for re-commissioned systems include ensuring management interfaces are not exposed to the internet, updating to the latest software versions, removing unsupported systems, and enforcing strong, unique administrator passwords. The NCSC strongly advises enabling multi-factor authentication for all VPN and device management logins and enforcing PBKDF2 for administrator interfaces.
The NCSC's Early Warning service is available to UK organizations, offering alerts for malicious activity that could impact their networks, providing an opportunity to detect and respond to cyber incidents proactively.
