The FBI and US Secret Service have warned that criminals are breaking into Fortinet FortiGate firewalls and VPN gateways around the world, in a campaign known as FortiBleed. Some businesses have been locked out of their own firewalls.
- What it is: Attackers use stolen or reused passwords to get into FortiGate VPN logins and firewall admin pages, then crack stored password hashes offline.
- Who is affected: Any business with a FortiGate firewall or VPN reachable from the internet. More than 86,000 devices in 194 countries have reportedly been compromised.
- The risk: Attackers create their own admin accounts, delete genuine ones and sell the access to ransomware groups.
- What to do: Reset all firewall admin and VPN passwords, end active sessions, and turn on multi-factor authentication for every remote access account.
- Also check: Look for admin accounts or API keys you do not recognise, and remove internet access to the firewall management page.
If you use FortiGate equipment, we recommend a review of your firewall accounts and logs this week. Contact OzComm and we will check it for you.