Cybercriminals Breach Fortinet Devices to Attack Major Companies

Fortinet firewalls and VPN systems used by tens of thousands of large companies and government organizations worldwide have fallen victim to a cyberattack. According to reports published by cybersecurity firms Hudson Rock and SOCRadar, tens of thousands of devices may have been compromised as part of this large-scale campaign. This was reported by Techcrunch.com reports it.

The most surprising aspect of this attack, dubbed "FortiBleed" by experts, is that hackers exploited simple negligence rather than complex system vulnerabilities. It appears that many companies failed to change the default passwords of their devices or continued to use passwords from previously leaked databases.

Global Giants at Risk

According to Hudson Rock, the list of affected organizations includes some of the world's most famous brands. Giants such as Samsung, Lenovo, Oracle, Siemens, Accenture, Foxconn, and PwC have been noted. So far, most of these companies have declined to provide an official comment on the situation, but independent researchers have confirmed that the leaked data is authentic.

The attack mechanism is very simple and effective: hackers use automated tools to scan for open Fortinet devices on the internet. Then, they attempt to gain access using lists of previously known passwords. Once inside, the device is turned into a "monitoring point," and all traffic passing through it, including new passwords, is stolen.

Scale and Geography of the Attack

According to analysis, the countries most affected by the cyberattack are:

• India;
• USA;
• Taiwan;
• Mexico.

However, specialists emphasize that victims are spread across the entire world. In terms of sectors, IT services, construction materials manufacturing, and telecommunications networks were targeted the most. Additionally, the SOCRadar report states that government agency systems were also breached.

Independent cybersecurity expert Kevin Beaumont analyzed the data and confirmed its authenticity. It is suspected that Russian-speaking hacking groups are behind this campaign. Fortinet has not yet issued an official statement regarding this situation.

This incident serves as an important warning for information technology specialists in Uzbekistan. It proves once again that in protecting corporate networks, not only is the installation of modern equipment necessary, but password security and the use of two-factor authentication systems are of critical importance.