FortiBleed still a bleeding nuisance as FBI confirms ongoing attacks

The FBI and US Secret Service issued a joint advisory on the FortiBleed campaign, reporting that criminals are using credentials from previous breaches and infostealer logs to credential-stuff internet-facing FortiGate firewalls and SSL VPNs, leading to the compromise of 86,644 devices across 194 countries; attackers extract and crack password hashes, create or delete accounts to maintain persistence and in some cases lock organizations out, and initial access has been supplied to ransomware affiliates (INC/Lynx, Payload). Agencies urge organizations to restrict internet-facing management, terminate active admin/VPN sessions, reset passwords, enable phishing-resistant MFA, and report incidents to help identify IOCs.