联邦调查局和美国特勤局（USSS）表示，犯罪分子使用与FortiBleed活动相关的凭据将组织锁定在Fortinet防火墙之外。这些机构周二发布了一份联合咨询，援引SOCRadar对194个国家/地区超过86，644台受感染设备的验证。他们的咨询[PDF]指出：“根据初步反应，如果威胁行为者删除或更改系统上原始帐户的密码，一些受害者可能会被Fortinet设备锁在外面。”
The FBI and US Secret Service (USSS) say criminals using credentials linked to the FortiBleed campaign are locking organizations out of their Fortinet firewalls. The agencies published a joint advisory on Tuesday, citing SOCRadar's verification of more than 86,644 compromised devices across 194 countries. "Based on initial responses, some victims may get locked out of their Fortinet devices if the threat actor either deletes or changes the password for original accounts on the system," their advisory [PDF] states. "During the initial intrusion, threat actors create new accounts not previously on the device. In certain cases, threat actors delete existing accounts to block organizations from accessing affected devices and to maintain persistence on the system while attempting lateral movement within the environment." The campaign targets internet-facing FortiGate firewalls and SSL VPN gateways. Criminals use credentials from earlier breaches and infostealer logs for credential stuffing and password spraying, then extract password hashes from compromised devices and crack them offline using GPU-accelerated clusters. The agencies urged organizations to restrict internet-facing management access, terminate active administrative and VPN sessions, reset passwords, and enable phishing-resistant multi-factor authentication.
“在最初的入侵过程中，威胁行为者会创建之前不在设备上的新帐户。在某些情况下，威胁行为者会删除现有帐户，以阻止组织访问受影响的设备，并在尝试在环境中横向移动时保持系统的持久性。“该活动的目标是面向互联网的FortiGate防火墙和SSL VPN网关。犯罪分子使用早期违规行为和信息窃取者日志的凭据进行凭据填充和密码喷洒，然后从受感染的设备中提取密码哈希，并使用GOP加速集群离线破解它们。这些机构敦促组织限制面向互联网的管理访问、终止活动的管理和VPN会话、重置密码并启用抗网络钓鱼的多因素身份验证。该公告还将FortiBleed与勒索软件活动联系起来，称初始访问代理向勒索软件附属机构提供了受损的网络访问权限。之前报道了SOCRadar确认的联系。目前的证据表明，为NEC/Lynx和Paylay勒索软件组织工作的附属机构利用了这些凭证，SOCRadar在7月份表示，它已经发现至少12起源自FortiBleed的已确认勒索软件攻击。这些机构鼓励受害者报告事件，同时指出组织没有义务提供信息来回应这一建议。
The advisory also links FortiBleed to ransomware campaigns, saying initial access brokers supplied compromised-network access to ransomware affiliates. The previously reported on the connection, identified by SOCRadar. The current evidence points to affiliates working for the INC/Lynx and Payload ransomware groups making use of the credentials, and SOCRadar said in July that it had seen at least 12 confirmed ransomware attacks stemming from FortiBleed.
联邦调查局（FBI）和特勤局（Secret Service）表示，受害者的报案信息有助于识别系统被入侵的迹象，并警告公众切勿支付赎金。
The agencies encouraged victims to report incidents, while noting that organizations were not obliged to provide information in response to this advisory. The FBI and the Secret Service said victim reports could help identify indicators of compromise and warned against paying ransoms. ®