CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure

Key Points:

• Main threat/vulnerability/incident: Malicious actors are exploiting compromised credentials of approximately 74,000 internet-accessible Fortinet devices, a situation referred to as FortiBleed.
• Impact assessment and affected systems: This incident affects FortiGate firewalls and SSL VPN gateways across both government and private sector organizations, potentially leading to unauthorized access and lateral movement within networks.
• Recommended actions or mitigations: CISA recommends immediate termination of sessions, resetting of credentials, enforcing strong password policies, enabling phishing-resistant MFA, and restricting management access to trusted internal networks.

Technical Details: The exposure involves leaked credentials that could allow attackers to gain unauthorized access to critical systems. Organizations are advised to implement the Password-Based Key Derivation Function 2 (PBKDF2) for secure credential storage.

MITRE ATT&CK Techniques:

• T1078 - Valid Accounts (Defense Evasion, Initial Access)
• T1071.001 - Application Layer Protocol: Web Protocols (Command and Control)

IOCs Mentioned: None mentioned