The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory calling on all organizations running Fortinet FortiGate appliances to take immediate action against a widespread attack campaign. Dubbed FortiBleed, the operation has already compromised an estimated 86,644 internet-facing devices globally, turning defensive network infrastructure into a potential threat vector.
A Weaponized Perimeter
The FortiBleed campaign, believed to be the work of Russian-speaking threat actors, represents a significant strategic shift in cyber adversary tactics. Attackers are specifically targeting perimeter security devices like FortiGate firewalls and VPN gateways — systems installed to defend networks — effectively weaponizing them to gain a privileged foothold.
Once compromised, these devices offer attackers a powerful position to monitor traffic, intercept credentials, facilitate lateral movement, and maintain persistent access while evading traditional security measures. The scale of the compromise highlights a growing and alarming trend where under-patched and under-monitored edge infrastructure becomes a primary target for well-resourced threat actors.
An Urgent Call to Action
In its advisory, CISA has urged Fortinet customers to take several critical steps to secure affected appliances. Among the agency's key directives, organizations should immediately:
- Reset all passwords associated with FortiGate management interfaces, including administrator accounts and any stored VPN user credentials.
- Enable and enforce multi-factor authentication (MFA) across all FortiGate administrative and VPN access points to prevent credential-based attacks.
- Audit and patch all FortiGate devices by applying the latest security updates from Fortinet to close the vulnerabilities exploited by the campaign.
- Review network and device logs for indicators of compromise, including suspicious outbound connections, unexpected configuration changes, and unauthorized administrative sessions.
Organizations that identify evidence of a breach must assume that internal network segments accessible from the compromised appliance are also at risk and should initiate broader forensic investigations accordingly.
The Broader Lesson
While specific threat actor details have not been fully confirmed, the FortiBleed incident serves as a critical reminder. Perimeter devices are not "set-and-forget" infrastructure; they are high-value targets that demand rigorous patch management, continuous monitoring, and stringent credential hygiene — including mandatory MFA — equal to that of core servers and applications.
Delaying action on advisories from agencies like CISA creates persistent, hard-to-detect footholds for attackers. Fortinet customers must treat this advisory as a top-tier priority and engage directly with the vendor's security response team for device-specific guidance. The integrity of an organization's entire defensive posture may depend on it.
美國網絡安全和基礎設施安全局（CISA）發佈緊急公告，呼籲所有運行 Fortinet FortiGate 設備的組織立即採取行動，應對一場大規模攻擊行動。這場被命名為 FortiBleed 的攻擊行動，已估計入侵了全球 86,644 台面向互聯網的設備，將防禦性的網絡基礎設施轉化為潛在的威脅載體。
被武器化的邊界防線
這場被認為與操俄語的威脅行為者有關的 FortiBleed 攻擊行動，代表著網絡對手戰術的一項重大策略轉變。攻擊者專門針對 FortiGate 防火牆和 VPN 閘道等邊界安全設備——這些系統本是為了防禦網絡而安裝的——有效地將其武器化，以獲取特權立足點。
一旦被入侵，這些設備便能為攻擊者提供強大的位置，用以監控流量、截取憑證、促進橫向移動，並在規避傳統安全措施的同時維持持久存取權限。此次入侵的規模凸顯了一個日益增長且令人警惕的趨勢：未充分修補和監控不足的邊緣基礎設施，正成為資源充足的威脅行為者的主要目標。
緊急行動號召
在公告中，CISA 敦促 Fortinet 客戶採取多項關鍵步驟來保護受影響的設備。在該機構的主要指引中，組織應立即：
- 重設所有與 FortiGate 管理介面相關的密碼，包括管理員帳戶及任何儲存的 VPN 用戶憑證。
- 在所有 FortiGate 管理和 VPN 存取點上啟用並強制執行多因素認證（MFA），以防範基於憑證的攻擊。
- 審計並修補所有 FortiGate 設備，應用 Fortinet 發佈的最新安全更新，以堵塞被此次攻擊行動利用的漏洞。
- 審查網絡及設備日誌，尋找入侵指標，包括可疑的外部連接、意外的配置變更以及未經授權的管理員會話。
發現入侵證據的組織，必須假設可從被入侵設備存取的內部網絡段同樣面臨風險，並應據此啟動更廣泛的取證調查。
更深層次的教訓
儘管特定的威脅行為者詳情尚未完全確認，但 FortiBleed 事件是一個關鍵的警示。邊界設備並非「設定後便可遺忘」的基礎設施；它們是高價值目標，需要與核心伺服器和應用程式同等嚴格的修補程式管理、持續監控以及嚴謹的憑證衛生管理——包括強制執行 MFA。
對 CISA 等機構發佈的公告延遲採取行動，會為攻擊者創造持久且難以偵測的立足點。Fortinet 客戶必須將此公告視為最高優先處理事項，並直接與供應商的安全回應團隊聯繫，以獲取針對特定設備的指導。組織整體防禦態勢的完整性可能取決於此。