Global Hacking Campaign Targets Fortinet Firewalls and VPNs

Cybercriminals have allegedly compromised tens of thousands of Fortinet firewalls and VPNs used by major companies all over the world. The hacking campaign, dubbed FortiBleed, appears to be ongoing and has been discovered by two cybersecurity firms: Hudson Rock and SOCRadar.

Attackers Exploit Known Passwords

The widespread hacking campaign does not involve exploiting any unknown vulnerabilities in the targeted devices. Instead, hackers are scanning the internet for exposed Fortinet firewalls and VPNs using automated tools, and then breaking into the devices with lists of previously known passwords. This allows them to steal more sensitive data from the victim companies.

According to SOCRadar, the hackers use compromised devices as a listening post, monitoring traffic passing through and collecting additional credentials that flow by. Those freshly collected passwords are then fed back into the scanner to compromise even more devices, creating a self-sustaining system.

Affected Companies and Industries

Hudson Rock reported finding evidence that suggests over 73,000 unique Fortinet URLs have been hacked, while SOCRadar said the total number of hacked devices exceeds 30,000. The affected companies include:

• Accenture
• Comcast
• Foxconn
• Lenovo
• Oracle
• Samsung
• Siemens
• PwC

The most affected countries are India, the United States, Taiwan, and Mexico. Industries such as IT services, construction materials, and telecommunications are also among the victims, according to Hudson Rock. Government agencies are also affected, per SOCRadar.

Countries and Industries Affected

The countries with the most affected devices are:

• India
• United States
• Taiwan
• Mexico

The most affected industries are:

• IT services
• Construction materials
• Telecommunications
• Government agencies

Behind the Hacking Campaign

According to both Hudson Rock and SOCRadar, the group behind the hacking campaign appears to be Russian-speaking. Fortinet did not respond to a request for comment.

Previous Hacking Campaigns

In recent years, several hacking campaigns have targeted and compromised Fortinet devices, usually abusing vulnerabilities in those systems. However, in this case, hackers are relying on leaked passwords, a simpler and less sophisticated attack.

Conclusion

The FortiBleed hacking campaign highlights the importance of strong password management and regular security audits. Companies must ensure that their sensitive systems are not exposed on the internet and that passwords are regularly changed to prevent such attacks.