What Happened?
Credential stuffing using leaked passwords
Password spraying attacks at scale
Automated brute-force login attempts
Exposure of Fortinet admin/VPN interfaces on the internet
Use of previously leaked configuration data
Once access was gained, attackers extracted configuration files from devices.
Scale of the Attack
30,000+ confirmed compromised devices (minimum estimate)
Up to 75,000–80,000 potentially affected firewalls
Impact across critical infrastructure sectors
Presence in 194 countries
Tens of thousands of valid credentials collected
Attack Chain
Internet scanning for exposed Fortinet portals
Credential stuffing and brute-force attacks
Login success on VPN/firewall interfaces
Extraction of configuration files
Reuse of credentials to expand access
Why It Matters
VPN access to internal networks
Lateral movement inside organizations
Exposure of Active Directory integrations
Data exfiltration
Persistent access through trusted systems
No Zero-Day Confirmed
No confirmed Fortinet zero-day
No breach of Fortinet itself
Main issue: exposed interfaces + weak credentials
Defense Measures
Reset all credentials
Enable MFA everywhere
Restrict admin interfaces from internet
Audit logs for suspicious logins
Review configurations and backups
Assume compromise if exposed publicly
ConnectMyAssets & Prevention
ConnectMyAssets helps reduce this kind of risk by improving visibility over exposed assets.
Continuous discovery of internet-facing assets
Detection of forgotten or exposed services
Identification of shadow IT
Centralized asset inventory
Faster detection of exposure changes
Key Takeaway
This incident shows that:
Misconfiguration is more impactful than exploitation
Visibility gaps create major security risks
Credential hygiene remains critical
