InfoSecBulletin Cybersecurity for mankind
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh. In an advisory CIRT said, the campaign has been observed globally, affecting organizations across 194 countries.
The systems have the “fortibleed” label, meaning they might be at risk for losing login details and being accessed without permission due to issues with FortiGate.
A single call: ShinyHunters Gained Access to 6 Million Customers’ Records
The first zero-click worm to spread through WeChat calls across iOS and Android
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
The FortiBleed campaign is a big effort to steal login info from Fortinet FortiGate devices that connect to the internet. Reports show that hackers are taking advantage of FortiGate systems that were hacked or had flaw before to get login details and keep access to business networks.
FortiBleed is different from usual remote code attacks. It mainly aims to steal and reuse login details instead of launching attacks right away. The stolen credentials let attackers get past security barriers and log in as real users using FortiGate SSL-VPN services.
FortiBleed Attack Lifecycle: From Credential Theft to Ransomware
The FortiBleed campaign starts with scanning the internet for weak FortiGate SSL-VPN devices. After finding them, attackers steal important login information like usernames, passwords, session cookies, VPN settings, and tokens to access the devices without using brute-force methods.
After getting into the VPN, bad actors look around inside, check Active Directory, steal login info using tools like Mimikatz, gain higher access, and spread across the network using RDP, SMB, PsExec, WinRM, and WMI. Often, this leads to stealing data and installing ransomware, using methods linked to groups like Akira ransomware, LockBit, INC Ransom, Play ransomware, and Black Basta.
Key signs of unusual behavior are strange VPN logins, odd login locations, checking Active Directory, collecting Kerberos tickets, spreading passwords, stuffing credentials, and illegal remote admin actions. All of these should be seen as possible signs of being compromised.
FortiBleed Detection & Monitoring
Organizations should improve monitoring on FortiGate firewalls, SSL-VPN systems, and Active Directory to find signs of FortiBleed-related issues and misuse of credentials.
FortiGate Appliances: Watch for unauthorized logins by admin, unexpected changes in settings, firmware updates, exports of settings, and strange login activity.
Organizations using FortiGate devices should quickly check if their systems are affected, change all passwords linked to FortiGate devices, look at login records, and search for signs of unauthorized access.
