Security Bulletin

❓What:

• The FBI and US Secret Service issued a warning on October 6 that the FortiBleed campaign against Fortinet FortiGate firewalls and SSL VPN gateways is still ongoing. infosecurity-magazine

• The notice cites SOCRadar figures of 86,644 compromised devices across 194 countries. infosecurity-magazine

• The advisory cites no CVE. Fortinet believes attackers are reusing previously stolen credentials and brute-forcing devices with weak passwords and no MFA. dailysecurityreviewcybersecuritydive

• Attackers create new accounts and, in some cases, delete existing ones to block organizations from their own devices. helpnetsecurity

⚠️Impact:

• Ransomware affiliates from INC, Lynx and Payload are among those using the stolen access. infosecurity-magazine

• Locked-out organizations need remediation beyond standard patching and password resets. infosecurity-magazine

• Branch-office and third-party-managed appliances can be missed during routine security work. esecurityplanet

💡Recommendations:

• Inventory every internet-facing FortiGate, including branch locations.

• Enforce MFA on all VPN and admin access.

• Audit admin accounts, REST API keys, and config changes against the advisory’s list.

• Move from the older SHA-256 password storage to PBKDF2 on supported FortiOS versions. hackread

• Confirm you have out-of-band admin recovery for edge devices before you need it. socradar

Read the full story HERE