{"id":3118,"date":"2021-09-10T19:33:14","date_gmt":"2021-09-10T14:03:14","guid":{"rendered":"https:\/\/xiarch.com\/blog\/?p=3118"},"modified":"2021-09-10T19:33:17","modified_gmt":"2021-09-10T14:03:17","slug":"how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts","status":"publish","type":"post","link":"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/","title":{"rendered":"How Threat Actors Hijack Credentials for 500,000 Fortinet VPN Accounts"},"content":{"rendered":"\n
An attacker has exposed a list of around 500,000 Fortinet VPN login names and credentials that were purportedly difficult from exploitable devices last summer. While the attacker that the exploited Fortinet’s vulnerability has since been patched, they assert that many VPN passwords are still authorized.<\/p><\/p>\n\n\n\n
This leak is a serious incident as the VPN passwords could permit the attackers to access a network to perform data exfiltration, install Trojan and execute the ransomware attacks.<\/p><\/p>\n\n\n\n
Fortinet Passwords Exposed on a Hacking Forum<\/strong><\/h2>\n\n\n\n
A list of Fortinet passwords was leaked for free by an attacker known as \u2018Orange,\u2019 who is the administrator of the newly started RAMP hacking forum and a past operator of the Babuk Ransomware operation.<\/p><\/p>\n\n\n\n
After the conflict occurred between the members of the Babuk group, Orange split off to initiate RAMP and is now expected to be a representative of the advanced Groove ransomware operation.<\/p><\/p>\n\n\n\n
In previous days, the attackers generated a post on the RAMP forum with a link to a file that suspected contains thousands of Fortinet VPN accounts.<\/p><\/p>\n\n\n\n
<\/figure><\/div>\n\n\n\n
At the same time, a post comes on Groove ransomware\u2019s data leak site also promoting the Fortinet VPN leak.<\/p><\/p>\n\n\n\n
<\/figure><\/div>\n\n\n\n
Both of the posts lead to a file hosted on a Tor storage server used by the Groove group to host hijacked files leaked to pressure the ransomware victims to pay. Our experts examine this file that shows that it contains VPN passwords for 498,908 users over 12,856 devices.<\/p><\/p>\n\n\n\n
While we did not test if any of the leaked passwords were authorized, our experts can confirm that all of the IP address we checked are Fortinet VPN servers. Moreover examine conducted by Advance Intel shows that the IP address is for devices across the world, with 2,959 devices located in the USA.<\/p><\/p>\n\n\n\n
<\/figure><\/div>\n\n\n\n
Kremez told our experts that the now-patched Fortinet CVE-2018-13379 vulnerability was exploited to collect these credentials. A source in the cybersecurity industry told our experts that they were able to legally verify that at least some of the leaked credentials were valid.<\/p><\/p>\n\n\n\n
However, some sources are giving mixed answers, with some saying many credentials work, while others state that most do not. It is still not clear why the attacker released the passwords rather than using them for themselves, but it is believed to have been done to promote the RAMP hacking forum and the Groove ransomware-as-a-service operation.<\/p><\/p>\n\n\n\n
“We believe with high confidence the VPN SSL leak was likely accomplished to promote the new RAMP ransomware forum offering a “freebie” for wannabe ransomware operators.” Advanced Intel CTO Vitali Kremez told our experts.<\/p><\/p>\n\n\n\n
Groove is a relatively new ransomware operation that only has one victim currently listed on their data leak site. However, by offering freebies to the cybercriminal community, they may be hoping to recruit other threat actors to their affiliate system.<\/p><\/p>\n\n\n\n
What Should Fortinet VPN server Admins Need to do?<\/strong><\/h2>\n\n\n\n
While our experts cannot legally verify the list of credentials, if you are an administrator of Fortinet VPN servers, you should assume that many of the listed credentials are valid and take precautions.<\/p><\/p>\n\n\n\n
These precautions include performing a forced reset of all user passwords to be safe and to check your logs for possible intrusions.<\/p><\/p>\n\n\n\n
<\/figure><\/div>\n\n\n\n
If anything looks suspicious, you should immediately make sure that you have the latest patches installed, perform a more thorough investigation, and make sure that your user’s passwords are reset.<\/p><\/p>\n\n\n\n
To check if a device is part of the leak, a security researcher has created a list of the leaked device’s IP addresses.<\/p><\/p>\n\n\n\n
While Fortinet never responded to our emails about the leak, after we emailed them about the incident they published an advisory confirming our reporting that the leak was related to the CVE-2018-13379 vulnerability.<\/p><\/p>\n\n\n\n
“This incident is related to an old vulnerability resolved in May 2019. At that time, Fortinet issued a PSIRT advisory and communicated directly with customers.<\/p><\/p>\n\n\n\n
And because customer safety is our top preference, Fortinet consequently issued various corporate blog posts detailing this issue, actively assisting customers to upgrade affected devices. In addition to advisories, bulletins, and direct interactions, these blogs were published in August 2019, July 2020, April 2021, and again in June 2021.” – Fortinet.<\/p><\/p>\n","protected":false},"excerpt":{"rendered":"
An attacker has exposed a list of around 500,000 Fortinet VPN login names and credentials that were purportedly difficult from exploitable devices last summer. While the attacker that the exploited Fortinet’s vulnerability has since been patched, they assert that many VPN passwords are still authorized. This leak is a serious incident as the VPN passwords […]<\/p>\n","protected":false},"author":2,"featured_media":3120,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[],"yoast_head":"\n
How Threat Actors Hijack Credentials for 500,000 Fortinet VPN Accounts - Xiarch Solutions Private Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How Threat Actors Hijack Credentials for 500,000 Fortinet VPN Accounts - Xiarch Solutions Private Limited\" \/>\n<meta property=\"og:description\" content=\"An attacker has exposed a list of around 500,000 Fortinet VPN login names and credentials that were purportedly difficult from exploitable devices last summer. While the attacker that the exploited Fortinet’s vulnerability has since been patched, they assert that many VPN passwords are still authorized. This leak is a serious incident as the VPN passwords […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/\" \/>\n<meta property=\"og:site_name\" content=\"Xiarch Solutions Private Limited\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/xiarch\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-09-10T14:03:14+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-09-10T14:03:17+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/How-Threat-Actors-Hijack-Credentials-for-500000-Fortinet-VPN-Accounts-featured-image.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"525\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Xiarch Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@xiarch\" \/>\n<meta name=\"twitter:site\" content=\"@xiarch\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Xiarch Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/\"},\"author\":{\"name\":\"Xiarch Security\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\"},\"headline\":\"How Threat Actors Hijack Credentials for 500,000 Fortinet VPN Accounts\",\"datePublished\":\"2021-09-10T14:03:14+00:00\",\"dateModified\":\"2021-09-10T14:03:17+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/\"},\"wordCount\":695,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"articleSection\":[\"Vulnerabilities\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/\",\"url\":\"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/\",\"name\":\"How Threat Actors Hijack Credentials for 500,000 Fortinet VPN Accounts - Xiarch Solutions Private Limited\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#website\"},\"datePublished\":\"2021-09-10T14:03:14+00:00\",\"dateModified\":\"2021-09-10T14:03:17+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/xiarch.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How Threat Actors Hijack Credentials for 500,000 Fortinet VPN Accounts\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/xiarch.com\/blog\/#website\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"name\":\"Xiarch Solutions Private Limited\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/xiarch.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\",\"name\":\"Xiarch\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"contentUrl\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"width\":300,\"height\":300,\"caption\":\"Xiarch\"},\"image\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/xiarch\/\",\"https:\/\/twitter.com\/xiarch\",\"https:\/\/www.linkedin.com\/company\/xiarch\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\",\"name\":\"Xiarch Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"caption\":\"Xiarch Security\"},\"sameAs\":[\"https:\/\/xiarch.com\/blog\/\"],\"url\":\"https:\/\/xiarch.com\/blog\/author\/vector\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How Threat Actors Hijack Credentials for 500,000 Fortinet VPN Accounts - Xiarch Solutions Private Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/","og_locale":"en_US","og_type":"article","og_title":"How Threat Actors Hijack Credentials for 500,000 Fortinet VPN Accounts - Xiarch Solutions Private Limited","og_description":"An attacker has exposed a list of around 500,000 Fortinet VPN login names and credentials that were purportedly difficult from exploitable devices last summer. While the attacker that the exploited Fortinet’s vulnerability has since been patched, they assert that many VPN passwords are still authorized. This leak is a serious incident as the VPN passwords […]","og_url":"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/","og_site_name":"Xiarch Solutions Private Limited","article_publisher":"https:\/\/www.facebook.com\/xiarch\/","article_published_time":"2021-09-10T14:03:14+00:00","article_modified_time":"2021-09-10T14:03:17+00:00","og_image":[{"width":1000,"height":525,"url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/How-Threat-Actors-Hijack-Credentials-for-500000-Fortinet-VPN-Accounts-featured-image.jpg","type":"image\/jpeg"}],"author":"Xiarch Security","twitter_card":"summary_large_image","twitter_creator":"@xiarch","twitter_site":"@xiarch","twitter_misc":{"Written by":"Xiarch Security","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/#article","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/"},"author":{"name":"Xiarch Security","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c"},"headline":"How Threat Actors Hijack Credentials for 500,000 Fortinet VPN Accounts","datePublished":"2021-09-10T14:03:14+00:00","dateModified":"2021-09-10T14:03:17+00:00","mainEntityOfPage":{"@id":"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/"},"wordCount":695,"commentCount":0,"publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"articleSection":["Vulnerabilities"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/","url":"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/","name":"How Threat Actors Hijack Credentials for 500,000 Fortinet VPN Accounts - Xiarch Solutions Private Limited","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/#website"},"datePublished":"2021-09-10T14:03:14+00:00","dateModified":"2021-09-10T14:03:17+00:00","breadcrumb":{"@id":"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/xiarch.com\/blog\/how-threat-actors-hijack-credentials-for-500000-fortinet-vpn-accounts\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/xiarch.com\/blog\/"},{"@type":"ListItem","position":2,"name":"How Threat Actors Hijack Credentials for 500,000 Fortinet VPN Accounts"}]},{"@type":"WebSite","@id":"https:\/\/xiarch.com\/blog\/#website","url":"https:\/\/xiarch.com\/blog\/","name":"Xiarch Solutions Private Limited","description":"","publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/xiarch.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/xiarch.com\/blog\/#organization","name":"Xiarch","url":"https:\/\/xiarch.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","contentUrl":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","width":300,"height":300,"caption":"Xiarch"},"image":{"@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/xiarch\/","https:\/\/twitter.com\/xiarch","https:\/\/www.linkedin.com\/company\/xiarch"]},{"@type":"Person","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c","name":"Xiarch Security","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","caption":"Xiarch Security"},"sameAs":["https:\/\/xiarch.com\/blog\/"],"url":"https:\/\/xiarch.com\/blog\/author\/vector\/"}]}},"_links":{"self":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3118"}],"collection":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/comments?post=3118"}],"version-history":[{"count":1,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3118\/revisions"}],"predecessor-version":[{"id":3125,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3118\/revisions\/3125"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media\/3120"}],"wp:attachment":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media?parent=3118"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/categories?post=3118"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/tags?post=3118"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"How-Threat-Actors-Hijack-Credentials-for-500000-Fortinet-VPN-Accounts-image1\"](\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/How-Threat-Actors-Hijack-Credentials-for-500000-Fortinet-VPN-Accounts-image1.jpg\")
<\/figure><\/div>\n\n\n\n![\"How-Threat-Actors-Hijack-Credentials-for-500000-Fortinet-VPN-Accounts-image2\"](\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/How-Threat-Actors-Hijack-Credentials-for-500000-Fortinet-VPN-Accounts-image2.jpg\")
<\/figure><\/div>\n\n\n\n![\"How-Threat-Actors-Hijack-Credentials-for-500000-Fortinet-VPN-Accounts-image3\"](\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/How-Threat-Actors-Hijack-Credentials-for-500000-Fortinet-VPN-Accounts-image3-1024x703.jpg\")
<\/figure><\/div>\n\n\n\n![\"How-Threat-Actors-Hijack-Credentials-for-500000-Fortinet-VPN-Accounts-image4\"](\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/How-Threat-Actors-Hijack-Credentials-for-500000-Fortinet-VPN-Accounts-image4.png\")
<\/figure><\/div>\n\n\n\n