Week in review: 74k Fortinet firewall credentials stolen, Splunk Enterprise RCE under active attack

Key Points:

• Main threat: Approximately 74,000 Fortinet firewall credentials were exposed in a data leak known as FortiBleed, attributed to a Russian-speaking cybercriminal group.
• Impact assessment and affected systems: The leaked credentials are from configuration files of Fortinet firewalls and VPN gateways, potentially allowing unauthorized access to numerous networks globally.
• Recommended actions or mitigations: Organizations using Fortinet products should immediately rotate their credentials, review access logs for suspicious activity, and apply any available patches to mitigate further risks.

Technical Details: The exposure resulted from the accidental release of configuration files by the cybercriminal group, which included sensitive information that could facilitate unauthorized access to affected systems.

MITRE ATT&CK Techniques:

• T1078 - Valid Accounts (Defense Evasion, Initial Access)

IOCs Mentioned: None mentioned