FBI and Secret Service warn FortiBleed enables lockouts and ransomware

The FBI and Secret Service warned Tuesday that the ongoing FortiBleed credential compromise campaign can lock organizations out of Fortinet firewalls and VPN gateways and provide initial access for ransomware attacks, CyberScoop reported. Attackers use stolen credentials to access exposed devices, create administrator accounts and change passwords or disable accounts. Initial access brokers are supplying access to ransomware affiliates including INC/Lynx and Payload. The agencies recommend restricting or removing internet administration, resetting credentials, enabling multifactor authentication and checking users and logs for unauthorized activity. Account changes can require remediation beyond standard patching and password resets.