FortiBleed Attackers Gain Ground: Locking Organizations Out of Their Firewalls

Recent findings from the FBI's investigation into the FortiBleed attacks have uncovered a troubling new capability of attackers: the ability to lock organizations out of their own firewall systems while remaining logged in themselves. This ongoing incident has already impacted over 80,000 devices globally, showcasing a sophisticated operational strategy from the attackers. The implications here stretch far beyond mere technical breaches; we're witnessing an evolution in how cybercriminals conduct operations, making traditional defenses insufficient.

Investigation Overview

After accessing a backend server left vulnerable by the attackers, the FBI, along with the US Secret Service, revealed insights into the intruders' infrastructure. This includes tools for processing stolen credentials and conducting password cracking algorithms. The attackers were not just looking for quick hits; they were ranking potential targets based on revenue and network structure, suggesting a methodical approach to their campaign. The meticulous planning behind these attacks is indicative of a well-funded, organized cybercrime group—something that organizations, large and small, need to prepare against.

Attackers Can Lock Defenders Out

The newly disclosed capability for attackers to lock organizations out of their firewalls presents a pressing risk. The FBI indicated that some victims may find themselves unable to access their FortiGate devices as attackers manipulate credentials by deleting or altering existing accounts. This is more significant than it looks. When adversaries gain such control, the entire defense mechanism of the organization is compromised.

During a breach, attackers have taken to creating new administrative accounts on the devices, often deleting existing ones to hinder recovery efforts by organizations. “Losing access to your firewall isn’t something you can just patch,” warned Ben Bernstein, a cybersecurity manager at Huntress. “Organizations may face the daunting task of physically resetting their equipment and rebuilding it from scratch.” Recovering from such a situation involves not just technical fixes but also operational overhauls that can paralyze daily activities.

The FBI has provided account names and indicators linked to this malicious activity, urging organizations to scrutinize Fortinet accounts for unauthorized modifications. This includes a recommended review of firewall logs, authentication methods, and Active Directory environments for any suspicious behavior. What this means for you, if you're working in this space, is that proactive measures must be established—waiting for a breach to react is no longer feasible in today's cyber environment.

Attackers Leverage GPU Power for Cracking

Further investigation revealed that attackers have been renting GPU resources to efficiently crack passwords, using tools like Hashcat and Hashtopolic for this purpose. They can distribute their password cracking jobs effectively, gaining access without triggering alerts for failed logins. This practice highlights a growing trend in cyberattacks where computing resources are rented rather than owned, reflecting a shift in operational tactics.

“Attackers are stealing configurations, executing offline password hashes, and gaining access on their first attempt,” Bernstein noted. What sets the FortiBleed campaign apart is the contrast between its stealthy initial access phase and the aggressive takeover that follows. The dual nature of their strategy—quiet infiltration followed by overt action—demands a nuanced understanding of cybersecurity protocols. Organizations must reevaluate their defensive architectures to address these sophisticated attack vectors.

FBI investigators uncovered critical infrastructure, including command-and-control servers responsible for orchestrating attacks. Several IP addresses linked to brute-force activity were identified, alongside guidelines for organizations to investigate whether they have been compromised. However, some of the infrastructure might be dynamically assigned, complicating detection efforts. Security teams face an uphill battle in identifying and securing against such fluid tactics.

Evidence also indicates that attackers maintained their hold on compromised systems post-initial breach. New accounts were created on FortiGate devices, and examples of account names found during investigations have been shared by the FBI. In some instances, the attackers exploited exposed SSH ports to facilitate their access. This insight unveils a basic yet often overlooked principle—basic security hygiene, such as proper port management and account monitoring, is non-negotiable.

Future Implications and Significance

The FortiBleed incident underscores a shift in the ambitions of cybercriminals. They’re no longer satisfied with simple data theft; they’re now locking out the very owners of the systems they compromise. This poses a serious challenge to traditional defense setups that primarily ensure perimeter security. Organizations must adopt a multi-faceted approach that includes continuous monitoring, staff training, and immediate incident response strategies.

This situation calls for a collective effort among IT departments, cybersecurity firms, and even government entities to create stronger guidelines and protective measures. Implementing layers of security, such as zero-trust architectures, could offer organizations a stronger defensive posture. The question is: how prepared are businesses to navigate this new world of cyber threats?

In essence, the implications of these findings ripple outward, affecting not just the organizations targeted but the entirety of the cybersecurity community. As fortifications strengthen in some areas, weaknesses in others will undoubtedly be exploited. Vigilance will be key, and organizations have no choice but to adapt—quickly.