A newly disclosed cyber campaign dubbed FortiBleed allegedly exposed administrator credentials for tens of thousands of internet-facing Fortinet firewalls, with maritime organizations emerging among the hardest-hit sectors. According to maritime cybersecurity firm Cydome, attackers obtained unauthorized administrative access to Fortinet devices by exploiting legacy password hashes stored in configuration files, exposing more than 86,000 confirmed working credentials across 194 countries. Cydome’s analysis identified more than 250 maritime and energy organizations in the leaked dataset, including shipping companies, ports, and satellite communications providers that support maritime operations.
Cydome warned that compromised firewall credentials could provide attackers with a pathway from IT environments into operational technology systems if network segmentation is weak. The company said attackers used compromised FortiGate devices to map networks, harvest additional credentials, and potentially pivot into systems such as Active Directory, while vessels lacking strict IT/OT separation could face risks extending to bridge systems, cargo management platforms, and VSAT communications.
Additionally, Cydome urged organizations to rotate all Fortinet administrative credentials, enable multifactor authentication, remove internet exposure from management interfaces where possible, and ensure administrators log in after upgrading FortiOS to eliminate legacy password hashes.
Read the rest of the story at Industrial Cyber.
