A large-scale security breach has affected tens of thousands of Fortinet firewalls globally, granting unauthorized access to numerous multinational corporations and government entities.

一次大規模的安全漏洞影響了全球數萬個 Fortinet 防火牆，導致眾多跨國公司與政府實體遭到未經授權的訪問。

The breach, identified as 'FortiBleed,' originated from the systematic scanning of internet-facing FortiGate remote login endpoints. Rather than exploiting previously unknown software vulnerabilities, the threat actors utilized a high-volume credential-spraying methodology. This process involved a custom binary employing 25,000 threads to test extensive lists of known passwords against targeted endpoints. Upon successful authentication, the actors established network footholds, which facilitated the interception of SSL VPN authentication hashes. These hashes were subsequently processed via a 45-GPU cluster using a recursive, 12-level feedback system, wherein successful password discoveries served as seeds for further candidate generation.

此次被命名為「FortiBleed」的入侵，源於對面向網際網路的 FortiGate 遠端登入端點進行系統性掃描。威脅參與者並非利用先前未知的軟體漏洞，而是採用了高容量的「憑證噴灑」（credential-spraying）方法。此過程使用了一個自定義二進位檔，透過 25,000 個執行緒將大量已知密碼清單對準目標端點進行測試。在成功通過驗證後，攻擊者建立了網路據點，從而便於攔截 SSL VPN 驗證雜湊值（hashes）。隨後，這些雜湊值透過一個 45 個 GPU 的集群，利用一個 12 層的遞迴反饋系統進行處理，將成功發現的密碼作為種子，用於生成更多候選密碼。

Stakeholder impact is extensive, with estimates of compromised devices ranging from 30,000 to approximately 74,000, representing nearly half of all internet-facing Fortinet firewalls according to Shodan polling. Affected entities include high-profile organizations such as Oracle, Samsung, Lenovo, and PwC, as well as critical infrastructure providers and government agencies. Geographically, the highest concentrations of compromised devices were observed in India, the United States, Taiwan, and Mexico. Of particular institutional concern is the confirmed exfiltration of classified defense documentation from a Turkish NATO contractor.

利害關係人的影響範圍極廣，估計受影響的設備數量在 30,000 至約 74,000 部之間，根據 Shodan 的調查，這幾乎佔了所有面向網際網路的 Fortinet 防火牆的一半。受影響的實體包括 Oracle、三星、聯想和 PwC 等知名組織，以及關鍵基礎設施供應商與政府機構。在地理分布上，印度、美國、台灣與墨西哥的受害設備最為集中。特別令體制擔憂的是，已確認一名土耳其 NATO 承包商的機密國防文件被外洩。

Following the initial perimeter breach, the actors transitioned to lateral movement within the target networks. This progression enabled the compromise of centralized authentication systems, specifically Microsoft Active Directory and Radius servers. Despite the technical sophistication of the password-cracking apparatus, researchers noted a lack of operational security, as the attackers left identifiable artifacts on their command-and-control infrastructure.

在初步突破邊界後，攻擊者轉而於目標網路內進行橫向移動。這一進程使得他們能夠入侵中心化驗證系統，特別是 Microsoft Active Directory 和 Radius 伺服器。儘管密碼破解設備在技術上非常精密，但研究人員指出其缺乏操作安全，因為攻擊者在其指令與控制基礎設施上留下了可識別的痕跡。

The current situation remains critical, as a significant portion of the compromised devices remain online and active.

目前的狀況依然嚴峻，因為仍有很大一部分被入侵的設備處於在線且活躍狀態。