Hackers Compromise Enterprise Firewalls, Expose 70K+ Credentials
A widespread cyberattack has breached network edge devices including Fortinet and Palo Alto firewalls. Attackers gained access to over 70,000 credentials and attempted deeper infiltration.
TL;DR
- Cybercriminals breached enterprise-grade firewalls and VPNs from Fortinet and Palo Alto Networks.
- Over 70,000 login credentials were compromised in the large-scale attack.
- The campaign targeted exposed network edge devices used by organizations globally.
- Attackers attempted lateral movement to further compromise affected systems.
- Organizations using these devices should audit access logs and rotate credentials immediately.
Security researchers have uncovered a significant cyberattack targeting enterprise network infrastructure. The campaign focused on widely-used firewall and VPN solutions from Fortinet and Palo Alto Networks, leading to the exposure of more than 70,000 login credentials.
This breach represents a critical threat to organizational security, as attackers leveraged compromised credentials to gain initial access and attempt deeper infiltration into victim environments. Companies utilizing these technologies are advised to take immediate action to assess their exposure and mitigate potential risks.
Attack Overview
- The campaign primarily targeted exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls.
- Researchers identified that attackers successfully extracted over 70,000 valid login credentials.
- Compromised devices were located across multiple industries and geographic regions.
- Initial access was likely achieved through unpatched vulnerabilities or misconfigured settings.
Impact and Response
- Post-access attempts included lateral movement and privilege escalation within networks.
- Some victims experienced secondary compromises following the initial breach.
- Security teams are advised to rotate all administrative credentials related to impacted devices.
- Organizations should conduct thorough log reviews to detect signs of unauthorized access.
- Immediate patching and proper configuration of edge devices is strongly recommended.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.