FortiBleed still a bleeding nuisance as FBI confirms ongoing attacks (opens in a new tab)
Why readFBI and USSS warn that threat actors are locking defenders out of Fortinet devices by hijacking admin credentials obtained via infostealers and password spraying.
A joint FBI and US Secret Service advisory alerts organizations that threat actors are using credentials from infostealer logs and prior breaches to lock admins out of FortiGate firewalls and SSL VPN gateways. Attackers extract password hashes, crack them offline, establish new persistent accounts, and delete legitimate original accounts across tens of thousands of exposed devices.
Also covered byCybersecurity Dive (opens in a new tab),BleepingComputer (opens in a new tab),The Record (opens in a new tab),The Hacker News (opens in a new tab).