What the Fortibleed campaign means for organizations running FortiGate firewalls

Researchers uncovered a large, automated credential-harvesting campaign against internet-exposed FortiGate management interfaces and SSL VPNs that used leaked/compromised credentials and brute force to intercept authentication traffic, extract hashes, and crack them using rented GPU resources. Attackers created stealthy admin accounts, pivoted via VPNs into internal networks using tools like Impacket and OpenFortiVPN, conducted AD audits and file-spidering to harvest more credentials, and left artifacts and lists of compromised devices; organizations are advised to check FortiBleed datasets, rebuild affected devices, rotate credentials and MFA, remove exposed management interfaces, and audit AD for lateral movement.