FortiBleed Actors Tamper With Accounts and Credentials on Fortinet Devices

En bref

• FortiBleed actors are targeting Fortinet devices by creating, deleting, and locking accounts.
• Victims face lockouts, removed accounts, and erased passwords.
• No CVE has been assigned, so the activity appears tied to access or configuration abuse rather than a single patched flaw.
• Admins should audit accounts, reset credentials, and restrict management access immediately.

Organizations that rely on Fortinet hardware are dealing with a disruptive access-control campaign attributed to the FortiBleed intrusion set. According to available reporting, the activity does not map to a specific CVE. Instead, the attackers are manipulating identity data on the affected equipment: provisioning new accounts, wiping existing ones, scrubbing passwords, and shutting legitimate users out of systems they need.

Victims in this campaign are experiencing more than a nuisance. When accounts disappear or credentials are erased, administrators and ordinary users can lose the ability to authenticate, manage devices, or restore normal operations. The impact includes denied access, removal of accounts, and deletion of passwords, which can halt troubleshooting and leave security teams responding to an incident without trusted access paths.

The absence of a CVE matters for prioritization. It suggests the threat may not be a single unpatched software bug but rather abuse of access controls, credentials, or device configuration. That makes standard vulnerability scanning insufficient on its own; identity and configuration reviews become equally important. Even at a medium severity rating, the operational and security consequences can be significant if administrative access is compromised.

Security teams should watch for unexpected account creation, unexplained account removal, password changes, and repeated lockouts on Fortinet devices. Logs from management interfaces, authentication services, and configuration changes are key evidence. Any sign of tampering should trigger containment, credential rotation, and a review of who can reach device administration functions.

Because the attackers are focused on accounts and passwords, recovery depends on having clean backups, documented admin workflows, and out-of-band access. Organizations should confirm they can restore configurations and re-establish trusted accounts without relying on potentially compromised credentials. Fortinet customers should also monitor vendor guidance and internal alerts for further details as the situation develops.

À faire maintenant

1. Audit every account on Fortinet devices and immediately disable or remove unknown, unused, or unauthorized accounts.
2. Reset passwords for all administrative and local accounts, using unique strong credentials and avoiding shared logins.
3. Enable multi-factor authentication for management access wherever the device or supporting infrastructure allows it.
4. Restrict administrative interfaces to trusted networks or VPNs, and disable management access from untrusted or public-facing paths.
5. Review authentication, account-change, and configuration logs for signs of account creation, deletion, password changes, or lockouts; preserve evidence before rotating credentials.
6. Back up current configurations and verify that trusted administrators can restore access and re-create essential accounts if deletions occur.
7. Apply the latest Fortinet firmware and security updates, and monitor vendor advisories for additional guidance even though no CVE is currently assigned.

Source originale

SecurityWeek