A large-scale cyber espionage and credential-harvesting operation is actively targeting Fortinet firewalls and VPN gateways, with more than 30,000 Internet-facing devices reportedly compromised across nearly 200 countries.
Researchers from SOCRadar discovered the campaign after finding an exposed operational server used by the attackers. That server gave researchers visibility into the group’s tooling, victim database, automation infrastructure, and verified credential repository.
The findings show how dangerous credential reuse, weak password hygiene, exposed management interfaces, and insufficient monitoring can become when combined with automation.
This was not a campaign based on random guesses. According to SOCRadar, the attacker database contained verified working usernames and passwords for tens of thousands of Fortinet devices belonging to companies and government organizations around the world.
What Was Discovered?
SOCRadar reported that the attacker-controlled database contained login credentials for more than 30,791 Fortinet devices.
The compromised devices were linked to:
- 21,108 unique IP addresses
- 8,316 unique domains
- organizations across 194 countries
- companies and government entities
- multiple critical sectors
The affected sectors include:
- telecommunications
- government
- healthcare
- education
- financial services
- critical infrastructure
Telecommunications organizations accounted for more than 5,600 compromised devices, while government organizations represented hundreds of affected systems across more than 100 domains.
Enterprise organizations with more than $1 billion in annual revenue reportedly made up over 20% of affected devices.
The scale of the campaign makes it a serious global perimeter security issue.
Credential Compromise, Not Fortinet Exploitation
SOCRadar emphasized that it did not find evidence that the campaign relied on the exploitation of a Fortinet software vulnerability.
Instead, researchers are treating it as a credential-compromise campaign.
That distinction matters.
The attackers did not need a zero-day or a new Fortinet CVE. They relied on:
- reused credentials
- leaked passwords
- default or built-in accounts
- weak administrator passwords
- long-lived credentials
- exposed management and VPN interfaces
- automated validation tools
This makes the campaign especially concerning because patching alone may not solve the problem.
If valid credentials are already exposed, attackers can log in through legitimate authentication paths.
Why Fortinet Devices Are High-Value Targets
Fortinet firewalls and VPN gateways are widely deployed across enterprises, governments, and critical infrastructure organizations.
These devices sit at the network edge and often control remote access into internal environments.
If attackers obtain valid credentials, they may be able to:
- access VPN services
- administer firewall settings
- monitor traffic
- collect additional credentials
- modify security policies
- create persistence
- disable protections
- pivot deeper into the network
- support espionage or ransomware operations
A compromised firewall or VPN gateway is not just another infected endpoint. It can become a strategic foothold at the perimeter of the organization.
How the Attack Chain Works
The operation appears to be built around a self-sustaining automated pipeline.
The attackers scan the Internet for exposed Fortinet devices and then attempt to authenticate using previously leaked or reused credentials.
The attack methods include:
- credential reuse
- credential stuffing
- password spraying
- automated login validation
- continuous scanning
- credential harvesting from compromised devices
Once attackers gain access to a device, they can use it as a listening post. According to SOCRadar, compromised devices may be used to monitor traffic and collect additional credentials passing through the environment.
Those newly collected credentials are then fed back into the automated system to compromise even more devices.
This creates a feedback loop.
The system finds devices, tests credentials, confirms valid access, harvests more credentials, and expands the victim pool.
Why Automation Makes This Worse
Credential attacks are not new. What makes this campaign especially dangerous is the scale and automation.
Attackers used tools that ran around the clock to test and validate credentials.
This means they could continuously:
- discover exposed devices
- test large credential sets
- verify working logins
- enrich victim data
- update their credential repository
- expand access across regions and sectors
Automation allows attackers to exploit poor password hygiene at a global scale.
Even a small percentage of successful logins can become thousands of compromised devices when the target pool is large enough.
Signs of Weak Security Hygiene
SOCRadar’s analysis found several common weaknesses among compromised devices.
These included:
- generic administrator accounts
- default Fortinet system accounts
- built-in accounts left enabled
- passwords reused across systems
- credentials never rotated after previous breaches
- exposed management interfaces
- weak remote-access controls
- insufficient MFA coverage
These are preventable weaknesses, but they remain widespread.
Attackers do not need sophisticated exploitation when basic credential controls are missing.
Why This May Be Espionage as Well as Cybercrime
SOCRadar assessed that the operation appears consistent with Russian-speaking threat actors.
The researchers pointed to tooling, infrastructure choices, and victim selection that was heavily weighted toward organizations in NATO member countries.
The campaign may be financially motivated, but the presence of credentials linked to what appeared to be a defense industry VPN endpoint raises concerns about cyber espionage.
The same access can serve multiple purposes.
A financially motivated actor can sell credentials to ransomware groups, fraud operators, or access brokers. A state-aligned actor can use the same access for intelligence collection, surveillance, or long-term positioning inside sensitive networks.
That makes the campaign dangerous regardless of the attacker’s final motive.
Countries and Sectors at Risk
The campaign affected organizations across Asia, Europe, the Americas, Africa, and the Middle East.
India and the United States reportedly accounted for nearly one-third of all identified credential compromises, but the victim distribution was global.
The most affected sectors included:
- telecommunications
- government
- healthcare
- education
- financial services
- critical infrastructure
These sectors are especially sensitive because Fortinet VPN and firewall access may protect systems that support essential operations, citizen data, patient information, financial records, or national infrastructure.
What Organizations Should Do Immediately
Any organization using Fortinet firewalls or VPN gateways should treat this campaign as urgent.
Recommended immediate actions include:
- rotate all Fortinet administrative credentials
- rotate all VPN user credentials
- enable MFA for all remote-access accounts
- enable MFA for all administrative accounts
- review all Fortinet local and built-in accounts
- remove or disable unused accounts
- remove public exposure of management interfaces where possible
- restrict management access to trusted IP ranges
- upgrade devices to the latest firmware
- review authentication logs for suspicious access
- review VPN logs for unusual logins
- check for logins from unexpected countries or IP ranges
- investigate failed login bursts or password spraying patterns
- check for configuration changes
- review firewall policies for unauthorized modifications
If suspicious access is found, treat the perimeter device as compromised and begin incident response.
Incident Response Guidance
If an organization believes its Fortinet device may be in the attacker dataset, password changes alone may not be enough.
The organization should investigate whether attackers used access before credentials were rotated.
Recommended response steps include:
- preserve logs before they roll over
- review all administrative sessions
- identify successful VPN logins from unusual sources
- inspect configuration backups
- compare current firewall configuration against a known-good baseline
- check for new admin accounts
- review policy changes
- inspect routing and VPN configuration
- look for traffic monitoring or forwarding changes
- check for evidence of lateral movement
- investigate internal systems accessed through VPN
- rotate credentials for accounts that authenticated through the device
- review identity provider logs
- monitor for follow-on activity
Because compromised perimeter devices may expose additional credentials, downstream systems should also be reviewed.
Why MFA Is Essential
Multi-factor authentication is one of the most important defenses against credential reuse.
If attackers have a valid username and password, MFA can prevent or at least slow unauthorized access.
For Fortinet environments, MFA should be enforced for:
- VPN users
- administrators
- privileged accounts
- remote-access groups
- emergency accounts where possible
Organizations should also review whether MFA bypasses exist, such as legacy access paths, local accounts, break-glass accounts, or unmanaged VPN profiles.
MFA must cover the paths attackers actually use.
Reduce Exposure of Management Interfaces
Firewall and VPN management interfaces should not be exposed broadly to the Internet.
Where possible, organizations should:
- disable public management access
- restrict management to internal networks
- require access through a secure jump host
- allow only trusted administrator IP addresses
- block management access from unknown countries
- separate VPN user access from administrative access
- monitor administrative login attempts
- use dedicated admin accounts
Perimeter devices are already high-risk. Exposing their management interfaces increases the attack surface unnecessarily.
Monitoring Recommendations
Security teams should monitor Fortinet devices for behavior linked to credential attacks and compromise.
Important signals include:
- repeated failed logins
- successful logins after many failures
- logins from unusual geographies
- use of generic admin accounts
- VPN access outside normal working hours
- multiple users logging in from the same IP
- one account logging in from multiple countries
- new administrator accounts
- configuration changes
- disabled logging
- firmware downgrade attempts
- policy changes allowing new access
- unusual outbound traffic from the device
Logs should be forwarded to a SIEM or centralized monitoring system so attackers cannot easily erase local evidence.
The Bigger Lesson: Credentials Are the Perimeter
This campaign shows that network appliances can be compromised without exploiting a software vulnerability.
If attackers obtain valid credentials, they can walk through the front door.
That means perimeter security must include strong identity controls, not only patching and firewall rules.
Organizations need to manage:
- password hygiene
- credential rotation
- MFA enforcement
- local account inventory
- privileged access
- exposed management services
- credential leak monitoring
- authentication logging
- incident response readiness
The firewall is only as strong as the credentials protecting it.
Final Thoughts
The Fortinet credential-harvesting campaign uncovered by SOCRadar is a serious warning for organizations worldwide.
More than 30,000 Fortinet firewalls and VPN gateways were reportedly compromised across nearly 200 countries. The campaign did not require a new Fortinet vulnerability. It relied on exposed devices, reused credentials, weak password hygiene, and automated validation at scale.
For organizations using Fortinet products, the response should be immediate: rotate credentials, enforce MFA, restrict management access, review logs, update firmware, and investigate for signs of compromise.
Perimeter devices are high-value targets. Once attackers control the VPN or firewall, they may already be inside the network.
In modern security, protecting the edge means protecting the credentials that control it.
