#256: FortiBleed and the reuse of stolen firewall credentials

If your AI agent can read a credential, it can leak it

Prompt injection can expose the credentials your AI agents rely on. Join Infisical for a 30-minute live demo of Agent Vault, October 21 at 1 PM ET. You’ll see how credential brokering lets an agent use a service without ever reading its secret, plus how to limit which services each agent can reach and set its access to expire.

Save your spot

FortiBleed demonstrates why updating a firewall and recovering control of it require separate checks. A working password can remain useful after an upgrade. An additional administrator account can survive a reset of the original account. Access obtained through a VPN can also lead to compromises elsewhere in the network.

The FBI and US Secret Service’s 6 October advisory describes an ongoing credential-compromise and access-broker operation targeting exposed FortiGate firewalls and SSL VPN gateways. It reports credential reuse, offline password cracking, new administrator accounts and cases where legitimate administrators were locked out. Fortinet’s assessment says FortiBleed is not a newly disclosed vulnerability. [1]

The technical issue is therefore broader than finding an applicable patch. Defenders need to establish which authentication material was exposed, whether it still works, and what the attacker did with it.

What the public evidence establishes

CloudSEK examined an exposed attacker directory containing scanning scripts, cracking infrastructure, target records and post-exploitation tools. Its research connects these components to a workflow for validating and selling access. It also challenges company attribution and headline totals derived from registration data and mixed datasets. Appearance in such a dataset should prompt investigation, rather than be treated as proof that a named company’s internal network was compromised. [3]

The June research and October government advisory describe different publication points in an ongoing story. Neither provides a complete forensic record for every affected installation. This article distinguishes the reported toolchain from the general technical mechanisms that explain its significance.

Figure 1. A simplified synthesis of the reported workflow [1][3]. The return arrow represents newly recovered passwords returning to validation. Not every access attempt requires cracking, and not every victim experiences every stage.

Collection and validation are separate operations

A stolen credential record is a candidate, not necessarily a working login. Passwords change, devices move, accounts lose privileges and additional authentication can prevent access. Attackers must distinguish obsolete records from usable combinations of endpoint, identity and authentication material.

Two common methods help explain the online activity. Credential stuffing tests username and password pairs obtained elsewhere. Its success depends on reuse. Password spraying instead tries a small selection of passwords across multiple identities. By spreading attempts, an operator may avoid a threshold designed around repeated failures against one account. MITRE documents these as separate techniques: T1110.004 and T1110.003.

For detection, that distinction changes the unit of analysis. A rule watching one account for a burst of failures can miss a broad spray. Review failures across identities, sources and time windows, then correlate successful authentication. Where distributed sources are involved, grouping solely by source IP can fragment the evidence.

Successful authentication deserves attention too. A valid password may produce no conspicuous failure sequence on the targeted gateway. Compare the login with the administrator’s expected source network, normal access method and subsequent configuration activity. A new geography is a lead; an unexplained privileged change provides a stronger reason to investigate.

Hashcat and Hashtopolis divide the cracking work

The reported tooling includes Hashcat and Hashtopolis. [1] These are legitimate password-recovery tools whose capabilities can also support credential attacks.

Hashcat performs candidate-password testing against supported hash formats. Hashtopolis coordinates distributed work using Hashcat, allowing tasks to be shared across agents. Distributing a job improves utilisation and throughput, while the cost of testing each candidate still depends on the password-hashing scheme and its parameters. [6][7]

Offline cracking occurs against a copied verifier. The attacker calculates a candidate result and compares it with the stolen record wi