Threat intel
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Researchers have disclosed a large-scale campaign targeting exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, that has exposed more than 70,000 credentials, according to The Hacker News.
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices, including Fortinet FortiGate firewalls and Palo Alto Networks GlobalProtect VPN gateways, according to The Hacker News.
The report states that the campaign has exposed more than 70,000 credentials. Artifacts from the investigation also indicate that the operators behind the campaign have obtained access to numerous organizations worldwide and have attempted to further compromise some victims, suggesting the activity may extend beyond initial credential theft into deeper intrusions.
Network edge devices such as firewalls and VPN concentrators are a frequent target for attackers because they sit at the boundary between internal corporate networks and the public internet, are directly reachable by remote users, and often store or process highly privileged credentials. A successful compromise of such a device can give intruders a durable foothold inside an organization's environment, enabling lateral movement, interception of traffic, data theft and follow-on attacks.
Security teams are generally advised to treat edge appliances as high-risk assets: apply vendor patches promptly, restrict or disable internet-facing management interfaces, enforce multi-factor authentication on remote access, monitor for anomalous logins, and rotate credentials whenever exposure is suspected. Organizations running Fortinet or Palo Alto Networks gear may wish to review their exposure in light of the reported campaign.
Full details of the investigation are available in the original report published by The Hacker News.
Source: The Hacker News
