July 1, 2026 • 4 mins
Got a question or comment? Message us here!
FortiBleed is turning perimeter defenses into attack infrastructure.
In this episode, we unpack how adversaries exploit FortiOS vulnerabilities, harvest credentials directly from firewalls, and pivot deeper into networks, plus detection strategies, threat hunting tips, and mitigation guidance for SOC teams.
Watch full episodes at youtube.com/@aliascybersecurity.
Listen on Apple Podcasts, Spotify and anywhere you get your podcasts.
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
SPEAKER_00 (00:02):
Good morning, good afternoon, or good evening,
whenever you may be, and welcometo another episode of The Sock
Brief.
This is your go-to podcast forstaying ahead of the
ever-evolving world ofcybersecurity threats.
I'm your host, Andrew, and todaywe're going to discuss a
concerning new campaign activelytargeting Fortinet firewalls.
(00:24):
Big surprise on that one.
Researchers are calling itFortableed, and the attackers
are using it to turn thesesecurity appliances into
credential stealers while theattacks continue to spread.
We'll discuss how it works, whyit's effective, and some
practical steps your SOC cantake to detect and defend
against it.
(00:45):
So let's start with what we knowabout the Fortableed attacks.
So Fortinet firewalls are widelyused across enterprise
environments because they'rereliable, feature-rich, and
user-friendly.
Unfortunately, attackers havecontinued to find ways to abuse
vulnerabilities in Forty OS,particularly in the SSO VPN and
(01:06):
management interfaces of thedevices.
Once the attackers gain afoothold, they deploy custom
tools that turn the firewallitself into a credential
harvesting machine.
The attackers are stealingcredentials from connected
users, VPN sessions, and evenadministrative accounts.
And what makes this campaignparticularly interesting is that
(01:28):
the firewall is both the entrypoint and the attacker's tool.
They're using it to captureusernames and passwords as they
flow through the device, thenusing those stolen credentials
to move deeper into the networkor just selling them on the dark
web.
Reports are showing that theattacks have been ongoing for
several weeks, with multipleorganizations affected across
(01:50):
different industries.
And because firewalls aresupposed to be the gatekeepers
for our internal environments,when one gets turned against
you, it undermines the entireperimeter.
Many organizations don't monitortheir firewalls as closely as
they should, and this givesattackers a quiet place to
operate.
The credential stealing aspectalso means one compromised
(02:13):
firewall can lead to widespreadaccount takeovers.
For detection on this one, SOCshould focus on visibility into
their firewall activity.
Look for things like unusualadministrative logins,
unexpected configurationchanges, or anomalous traffic
patterns coming from thefirewall itself.
Monitor for signs of credentialharvesting, such as spikes and
(02:37):
authentication attempts, or anykind of unusual VPN session
behaviors.
This is another great place fora sim because by integrating the
firewall logs into it, you cancorrelate events across
endpoints and the rest of thenetwork to get a much clearer
picture of what's happening.
On the prevention side, the mostimportant step is patching, and
(02:59):
we talk about that one a lot.
Fortinet has already releasedupdates to address the
vulnerabilities being exploited,so make sure you're on the
latest version.
Also, restrict management,access to the firewall, and
absolutely never expose theadmin interface to the internet.
Use strong MFA for all youradministrative accounts and
(03:21):
consider network segmentation sothat even if a firewall is
compromised, the reach islimited.
For threat hunting, just beingproactive and regularly
reviewing firewall logs for anykind of suspicious activity.
That's a big one.
Scan for known Fortableedindicators and test your
incident response plan with ascenario that starts with a
(03:42):
compromised perimeter device.
Make sure you're sharing thisinformation internally so your
network and security teams arealigned on the risk.
And this Fortableed campaignshows that even security devices
can be turned into offensivetools.
So here's uh closing thoughtsand a call to action on this
one.
The ongoing Fortableed attacksare a reminder that no device is
(04:06):
truly immune, especially when itsits at the edge of your
network.
Socks really need to monitorlogs, patch regularly, and
maintain strong segmentation tokeep these threats contained.
So this week, if you runFortiGates in your environment,
review them for exposure andverify that they're fully
patched to the latest versions.
(04:28):
Run a quick hunt for anomalousactivity on those systems and
share the findings with yourteam.
And that's a wrap for thisepisode of Sock Brief.
Have questions or your ownfirewall stories?
Hit us up on social media or viaour website.
Keep your eyes open, keepsharpening those skills, and
we'll talk soon.
As always, stay secure outthere.
(04:48):
Bye.
Good morning, good afternoon, or good evening,
whenever you may be, and welcometo another episode of The Sock
Brief.
This is your go-to podcast forstaying ahead of the
ever-evolving world ofcybersecurity threats.
I'm your host, Andrew, and todaywe're going to discuss a
concerning new campaign activelytargeting Fortinet firewalls.
(00:24):
Big surprise on that one.
Researchers are calling itFortableed, and the attackers
are using it to turn thesesecurity appliances into
credential stealers while theattacks continue to spread.
We'll discuss how it works, whyit's effective, and some
practical steps your SOC cantake to detect and defend
against it.
(00:45):
So let's start with what we knowabout the Fortableed attacks.
So Fortinet firewalls are widelyused across enterprise
environments because they'rereliable, feature-rich, and
user-friendly.
Unfortunately, attackers havecontinued to find ways to abuse
vulnerabilities in Forty OS,particularly in the SSO VPN and
(01:06):
management interfaces of thedevices.
Once the attackers gain afoothold, they deploy custom
tools that turn the firewallitself into a credential
harvesting machine.
The attackers are stealingcredentials from connected
users, VPN sessions, and evenadministrative accounts.
And what makes this campaignparticularly interesting is that
(01:28):
the firewall is both the entrypoint and the attacker's tool.
They're using it to captureusernames and passwords as they
flow through the device, thenusing those stolen credentials
to move deeper into the networkor just selling them on the dark
web.
Reports are showing that theattacks have been ongoing for
several weeks, with multipleorganizations affected across
(01:50):
different industries.
And because firewalls aresupposed to be the gatekeepers
for our internal environments,when one gets turned against
you, it undermines the entireperimeter.
Many organizations don't monitortheir firewalls as closely as
they should, and this givesattackers a quiet place to
operate.
The credential stealing aspectalso means one compromised
(02:13):
firewall can lead to widespreadaccount takeovers.
For detection on this one, SOCshould focus on visibility into
their firewall activity.
Look for things like unusualadministrative logins,
unexpected configurationchanges, or anomalous traffic
patterns coming from thefirewall itself.
Monitor for signs of credentialharvesting, such as spikes and
(02:37):
authentication attempts, or anykind of unusual VPN session
behaviors.
This is another great place fora sim because by integrating the
firewall logs into it, you cancorrelate events across
endpoints and the rest of thenetwork to get a much clearer
picture of what's happening.
On the prevention side, the mostimportant step is patching, and
(02:59):
we talk about that one a lot.
Fortinet has already releasedupdates to address the
vulnerabilities being exploited,so make sure you're on the
latest version.
Also, restrict management,access to the firewall, and
absolutely never expose theadmin interface to the internet.
Use strong MFA for all youradministrative accounts and
(03:21):
consider network segmentation sothat even if a firewall is
compromised, the reach islimited.
For threat hunting, just beingproactive and regularly
reviewing firewall logs for anykind of suspicious activity.
That's a big one.
Scan for known Fortableedindicators and test your
incident response plan with ascenario that starts with a
(03:42):
compromised perimeter device.
Make sure you're sharing thisinformation internally so your
network and security teams arealigned on the risk.
And this Fortableed campaignshows that even security devices
can be turned into offensivetools.
So here's uh closing thoughtsand a call to action on this
one.
The ongoing Fortableed attacksare a reminder that no device is
(04:06):
truly immune, especially when itsits at the edge of your
network.
Socks really need to monitorlogs, patch regularly, and
maintain strong segmentation tokeep these threats contained.
So this week, if you runFortiGates in your environment,
review them for exposure andverify that they're fully
patched to the latest versions.
(04:28):
Run a quick hunt for anomalousactivity on those systems and
share the findings with yourteam.
And that's a wrap for thisepisode of Sock Brief.
Have questions or your ownfirewall stories?
Hit us up on social media or viaour website.
Keep your eyes open, keepsharpening those skills, and
we'll talk soon.
As always, stay secure outthere.
(04:48):
Bye.
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
The Bobby Bones Show
Listen to 'The Bobby Bones Show' by downloading the daily full replay.