AI Autopsy: FortiBleed Shows Why Edge Devices Are Now Credential Attack Paths

At first blush, FortiBleed looks like a Fortinet story. It’s the easiest version to understand and the simplest to contain – you check the affected devices, rotate the credentials, apply the guidance and move on. But there are bigger lessons to be learned about perimeter identity.

FortiBleed shows how firewalls and VPN gateways have become credential stores, surveillance points and entry ramps into the enterprise. It also illustrates why attackers are spending so much time at the network edge, where defensive visibility is often weaker and a single successful login can open a path into everything behind it.

Rishi Kaushal, CIO at Entrust, tells Assured Intelligence the campaign should be understood primarily through the lens of identity exploitation.

“FortiBleed is a credential harvesting campaign targeting FortiGate firewalls and VPN gateways,” he says. “It centres on identity exploitation rather than a conventional software vulnerability, focusing on the compromise and reuse of credentials.” 

A perimeter failure, not just a patching failure

According to research summarised by the Cloud Security Alliance (CSA), FortiBleed involved large-scale credential compromise related to internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, with reported affected device counts ranging from roughly 74,000 to 87,000. The CSA said attackers systematically extracted configuration backup files from vulnerable devices by breaking outdated encryption offline.

Many devices still stored credentials as salted SHA-256 hashes rather than the stronger PBKDF2 algorithm Fortinet introduced in later firmware. Once configuration backups were obtained, attackers could work against the hashes offline – using GPU resources without triggering normal controls such as account lockouts.

“Perimeter security appliances are high-value targets, not just defensive barriers” Spence Hutchinson

Kaushal believes that this configuration backup aspect was significant because the backup file itself became the real target. “Although the attack initially focused on compromising credentials, the primary objective was to access the configuration backup file,” he explains. “This file contains administrator and user passwords stored by older versions of the FortiOS. Once obtained, these credentials could be cracked offline relatively easily without being limited by controls such as account lockouts after repeated attempts.”

Rik Turner, chief analyst at Omdia, makes a similar point. He says the configuration backup and offline cracking stage was “the driving force behind the campaign”, exposing credentials across many thousands of devices.

Turner also points to a deeper problem with remediation. Fortinet had introduced PBKDF2 password hashing in recent firmware updates, but Turner says the change was not automatically retroactive in every meaningful sense. Legacy hashes could remain until an administrator logged in again and triggered a re-hash.

“This ‘legacy data debt’ left thousands of devices with updated firmware vulnerable,” Turner tells Assured Intelligence.

This is an echo of an all-too-familiar pattern in the world of cybersecurity. A product may be technically patched, but the risk remains because old credentials, configurations, accounts or trust relationships are still alive inside the environment.

Why attackers keep coming for the edge

Turner also points to a consistent trend over the past three to four years: of threat actors targeting edge devices because they are useful, exposed and often poorly observed. In his view, part of that shift reflects the success of endpoint detection and response (EDR) vendors in making conventional endpoints harder to compromise quietly.

“By contrast, edge devices like switches, routers, firewalls, and VPN concentrators cannot support an EDR clients, which makes them far more susceptible to attacks,” he says.

Many of these devices sit outside the controls defenders rely on elsewhere, yet they are trusted by the rest of the network and often hold precisely the kind of access attackers want.

“Legacy data debt left thousands of devices with updated firmware vulnerable” Rik Turner

Spence Hutchinson, senior manager, threat intelligence at eSentire Threat Research Unit, says the same pattern is visible in threat actor communications and incident telemetry. The firm saw a fourfold year-on-year increase in account compromise attacks in 2025.

“VPN credentials sidestep that whole problem,” he tells Assured Intelligence. “They give an attacker a gateway into the network where they can effectively bring their own unmonitored device inside the firewall and operate from there.”

Hutchinson describes FortiBleed as “a massive credential exposure campaign” that highlights “a wider perimeter security failure” rather than a traditional software vulnerability. He says the attackers exploited weak or exposed administrative credentials, brute-forced internet-facing FortiGate interfaces using generic and targeted dictionaries, then used legitimate built-in diagnostic tools to capture authentication traffic without relying on malware.

From credential theft to ransomware

The stakes rose further when SOCRadar’s Threat Research Unit linked FortiBleed infrastructure to INC Ransom and Lynx ransomware operations. SOCRadar said an operator tied to FortiBleed infrastructure was found actively working negotiation panels for both groups, connecting mass FortiGate credential theft to ransomware deployment.

SOCRadar also said it had tracked scanning activity against roughly 11,250 FortiGate portals in more than 150 countries, confirmed admin-level access on 409 targets and full attack-chain completion on 354. It reported at least 12 ransomware deployments stemming from the access, with hundreds of endpoints encrypted across affected organisations.

This enforces that idea that exposure to FortiBleed should not be treated as a credential reset exercise alone. Once an account is compromised it opens the door to more persistent threats in the longer term.

What security teams should do now

The immediate response should be practical. Security teams need to terminate active administrative and SSL VPN sessions, rotate all FortiGate administrator passwords, and remove or rename default and generic accounts. Experts Assured Intelligence spoke to also recommend enforcing MFA, reviewing exposed management interfaces, and checking whether legacy hashes remain in backups or device configurations.

“Zero Trust principles apply directly here” Rishi Kaushal

Omdia’s Turner says organisations with an all-Fortinet firewall estate need to rotate the credentials residing across those devices while strengthening the broader firewall security posture. Where Fortinet represents only part of the estate, he argues that infrastructure should be isolated from the rest of the network “as far as possible” and treated as infected until credentials are rotated and the underlying issues are addressed.

For Entrust’s Kaushal, affected organisations should also operate under an assumed breach model. That means resetting credentials, enforcing MFA consistently, patching to current versions and monitoring logs for unauthorised access or persistence.

“Zero Trust principles apply directly here,” he adds. “Requiring strong, hardened MFA across all access points, not just passwords. Use device-based controls such as private certificates to ensure only trusted endpoints can connect.”

For eSentire’s Hutchinson, traditional vulnerability management is too narrow a frame for this kind of campaign.

“Patching software vulnerabilities is only one piece of the security puzzle,” he says. “This campaign thrives without relying on a zero-day exploit; it abused native features, weak passwords and exposed interfaces.”

In other words, a fully patched device can still be a problem if its management port is exposed to the internet and its administrative accounts lack strong authentication.

The board-level lesson

While “check your Fortinet devices” is the immediate operational response, the bigger issue is that perimeter appliances have become high-value identity systems.

“Once an account is compromised it opens the door to more persistent threats”

They decide who gets in, often contain credentials and configuration data, and provide visibility into internal traffic. They may sit outside normal monitoring coverage, but when compromised, they give attackers a trusted route into the network.

“Security leaders should be aware that perimeter security appliances are high-value targets, not just defensive barriers,” Hutchinson says. “The compromise of a firewall or VPN gateway grants an attacker the ultimate vantage point to monitor traffic, harvest credentials and pivot internally while maintaining a low profile.”

Omdia’s Turner goes further, arguing that VPNs should no longer be treated as security tools in themselves. He says CISOs should be looking at alternatives such as zero-trust network access (ZTNA), and considering how short-lived, frequently rotated credentials could reduce the usefulness of stolen access.

Entrust’s Kaushal offers more foundational advice: strong identity control, strong encryption and priority patching for externally exposed systems.

FortiBleed is a reminder that perimeter security is no longer just about blocking malicious traffic. It is about protecting the systems that decide who is trusted. Once those systems become credential collection points, the firewall stops being a wall and starts becoming an open door.