FortiBleed Attack: Massive Compromise of Fortinet Firewalls

What Happened?

• Credential stuffing using leaked passwords
• Password spraying attacks at scale
• Automated brute-force login attempts
• Exposure of Fortinet admin/VPN interfaces on the internet
• Use of previously leaked configuration data

Once access was gained, attackers extracted configuration files from devices.

Scale of the Attack

• 30,000+ confirmed compromised devices (minimum estimate)
• Up to 75,000–80,000 potentially affected firewalls
• Impact across critical infrastructure sectors
• Presence in 194 countries
• Tens of thousands of valid credentials collected

Attack Chain

• Internet scanning for exposed Fortinet portals
• Credential stuffing and brute-force attacks
• Login success on VPN/firewall interfaces
• Extraction of configuration files
• Reuse of credentials to expand access

Why It Matters

• VPN access to internal networks
• Lateral movement inside organizations
• Exposure of Active Directory integrations
• Data exfiltration
• Persistent access through trusted systems

No Zero-Day Confirmed

• No confirmed Fortinet zero-day
• No breach of Fortinet itself
• Main issue: exposed interfaces + weak credentials

Defense Measures

• Reset all credentials
• Enable MFA everywhere
• Restrict admin interfaces from internet
• Audit logs for suspicious logins
• Review configurations and backups
• Assume compromise if exposed publicly

ConnectMyAssets & Prevention

:contentReference[oaicite:0]{index=0} helps reduce this kind of risk by improving visibility over exposed assets.

• Continuous discovery of internet-facing assets
• Detection of forgotten or exposed services
• Identification of shadow IT
• Centralized asset inventory
• Faster detection of exposure changes

Key Takeaway

This incident shows that:

• Misconfiguration is more impactful than exploitation
• Visibility gaps create major security risks
• Credential hygiene remains critical