A credential harvesting operation targeting Fortinet firewalls has compromised roughly 74,000 devices across 21,000 IPs in 194 countries, exposing plaintext credentials for organizations including Oracle, Chevron, and Lenovo. Security researcher Bob Diachenko gained access to the attackers' C2 infrastructure and found logs containing not just credentials, but also metadata like industry, revenue, and employee counts for each victim.

The engineering story here is about scale and operational security. The threat actor deployed a custom binary with 25,000 threads to spray hundreds of thousands of FortiGate remote login endpoints with credential combinations. This is essentially a distributed brute-force pipeline—parallelized, stateful, and targeting a specific attack surface. Once inside, they used the firewall as a network tap, pivoting to centralized auth systems like RADIUS and Active Directory.

From a data engineering perspective, the attackers built a verified credential database. Researcher Kevin Beaumont confirmed with multiple victims that the exposed credentials are current and functional. The breach covers roughly half of all internet-facing Fortinet firewalls (based on Shodan census data), making this a near-complete population-level compromise of a specific device class.

The key takeaway for practitioners: this isn't a zero-day exploit. It's a credential stuffing attack against exposed administrative interfaces. The engineering failure is in access control and monitoring. If your FortiGate has remote login enabled, you're effectively running a public API for authentication. Audit your firewall logs for failed login bursts, check for unexpected RADIUS/AD integration traffic, and rotate all credentials immediately. The attackers' poor opsec—leaving their C2 server accessible—is the only reason we have visibility into the scale of this breach.

Source: Ars Technica