FortiGate and GlobalProtect edge devices hit by credential-theft campaign

Key points

• Attackers concentrated on FortiGate firewalls and GlobalProtect VPN gateways.
• Over 70,000 credentials were exposed across many organizations worldwide.
• Some compromised devices yielded network access and follow-on intrusion attempts.
• No CVE is tied to this activity; credential hygiene and edge hardening are the focus.

Campaign operators have been aiming at internet-facing security and remote-access gear, with Fortinet's FortiGate and Palo Alto Networks' GlobalProtect named as the primary targets. The activity is global and has affected a large number of organizations. No CVE has been linked to the operation, so the exposure centers on stolen or exposed sign-in material rather than a single patchable software flaw.

More than 70,000 credentials have been exposed in the campaign. That volume matters because firewall and VPN consoles are often the front door to internal networks; a single valid credential can bypass perimeter controls and give intruders a place to operate. The operators are described as having breached firewall and VPN systems, obtained access, and then tried to push further into victim environments.

Because the affected products sit at the network edge, the blast radius is not limited to one sector or region. Many organizations across the globe are implicated, and the exposed credentials create risk even where no follow-on compromise has been confirmed. Administrators should assume that reused or weak passwords on these appliances are especially dangerous.

With no CVE attached, patching alone will not close the exposure. The immediate priorities are credential rotation, multi-factor authentication enforcement, review of edge-device logs, and reduction of management interfaces exposed to the internet. Organizations should also look for signs of unauthorized sessions, new local accounts, configuration changes, and lateral movement from VPN or firewall appliances.

What to do now

1. Reset credentials for all FortiGate and GlobalProtect accounts; prioritize admin, VPN, and service accounts, and invalidate active sessions and tokens after rotation.
2. Enforce multi-factor authentication on VPN and administrative access; remove or restrict internet-exposed management interfaces to trusted IP ranges.
3. Review edge-device logs for anomalous logins, new accounts, configuration changes, and unusual outbound traffic; isolate suspected appliances.
4. Audit password reuse across firewall, VPN, and enterprise identities; force resets wherever reuse is found.
5. Apply current vendor hardening guidance and firmware updates even though no CVE is tied to this campaign.
6. Limit local accounts and apply least privilege; disable unused accounts and remote-access profiles.
7. Monitor for follow-on intrusion attempts from compromised appliances and block validated indicators.

Original source

The Hacker News