EN PT-BR
← Voltar ao feed
high

FortiBleed 2.0: Hudson Rock analyzes leaked FortiGate config dump with 40,573 cleartext secrets across 1,689 hosts

2 fonte(s) · 2 atualização(ões) · publicado 27/10/2026 09:28 · coletado há 4 dias

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 29/10/2026 00:03; os links antigos trazem para cá.

Fontes: gbhackers.com ↗ infostealers.com ↗

Hudson Rock published FortiBleed 2.0 on 27 October 2026, a follow-up analysis of newly obtained FortiGate configuration reports tied to the actor known as k0t. The data comprises 1,703 source files and 101,419 credential and account records across 1,689 host identifiers, and 40,573 of the records contain cleartext secrets (infostealers.com, gbhackers.com). Those include 37,076 local-user records and 1,576 Active Directory LDAP bind records. Report timestamps mostly fall on 20 February 2026, earlier than the likely May/June material in FortiBleed 1.0 (infostealers.com). The dataset adds 924 hosts (54.7%) and 975 domain labels (67.1% of the union) absent from the first dataset, but these are not newly confirmed breaches (infostealers.com, gbhackers.com). Hudson Rock stresses that the records measure recorded exposure, not confirmed internal compromise. Exposed secrets do not equal working access, and no single entry method has been established for every host.

Entenda a falha

A vulnerabilidade

CVE-2026-24858 (CVSS 9.4) is a FortiCloud SSO abuse issue affecting FortiOS, FortiProxy and FortiSwitchManager. The articles do not say what an attacker needs, what exactly they obtain, or which versions are affected or fixed; they only say Fortinet issued an advisory on 27 January 2026. The story is mainly about leaked FortiGate configuration reports, and the data does not establish this CVE as the initial access for any host. Fortinet's June assessment also discusses credential reuse and brute force.

Como funciona

The articles do not describe the internal mechanism of CVE-2026-24858 beyond calling it FortiCloud SSO abuse. They describe what follows a compromised device: the configuration is extracted, stored secrets are recovered, VPN logins are attempted, and LDAP bind accounts are used to probe internal systems. Whether a VPN session works depends on account status, VPN policy, MFA and network reachability.

Por que é vulnerável

The articles give no root cause for CVE-2026-24858 and do not say what the fix changes. On the exposure side, configurations using FortiOS's system-default key can allow offline recovery of reversibly encrypted (ENC) secrets, while device-specific private-data-encryption keys are supported. Recoverability therefore depends on version, settings and the material obtained.

Como foi descoberta

Fortinet published its advisory for CVE-2026-24858 on 27 January 2026. The configuration reports are mostly timestamped 20 February 2026 and are tied to the actor k0t. Hudson Rock obtained them only recently and analyzed them as FortiBleed 2.0, crediting NyxLab for the foundational research on k0t. Group-IB and NyxLab describe victim overlap with Qilin and The Gentlemen, but no affiliation is confirmed. The articles do not say who found the CVE itself.

Explicação gerada por IA a partir da matéria e dos artigos, em 29/10/2026 00:18.

Detalhes técnicos

  • Content: The 101,419 records include SH2 (10,376), PB2 (2,676), AK1 (316) and generic FortiOS_Hash (631) hashes, plus 36,104 empty password fields. The data also has 208 HA records (144 cleartext), 176 SMTP records (105 cleartext) and 1,672 administrator-login rows labeled Verified_Active_Login (1,633 with super_admin). These are source labels, not fresh authentication tests (infostealers.com, gbhackers.com).
  • Domains: Researchers found 1,453 domain labels, 975 of them absent from the earlier set. Some labels may identify service providers or email services rather than victims (gbhackers.com). Registration emails may belong to MSSPs or contractors rather than victims (infostealers.com).
  • Tooling: The workflow described around forti_parse.py extracts configs and secrets. vpn_checker.py with openconnect attempts VPN logins. NetExec (nxc) is used against internal systems (infostealers.com). Success depends on account status, network reachability, VPN rules and MFA (gbhackers.com).
  • Reversible secrets: Configs using FortiOS's default key may permit offline recovery of ENC secrets; device-specific keys change that risk (infostealers.com, gbhackers.com).
  • Overlap with FortiBleed 1.0: Of 765 shared hosts, 524 of 766 admin logins (68.4%) match exactly. The other 242 use different admin usernames, such as fgtsecure (106 occurrences), Technical_support, callcenter, fgtsec and forticloud-sync. In 216 of those, the 1.0 username coexists in the earlier System Admin table (infostealers.com).
  • MFA: Among local users, 4,114 records use fortitoken, 909 email, 18 fortitoken-cloud and 1 sms. A blank two_fa field (78,369 entries) is missing information, not proof that MFA was disabled (infostealers.com, gbhackers.com).
  • Disabled accounts: 7,437 of the cleartext local-user records are marked disabled.
  • LDAP impact: An exposed LDAP bind password does not automatically give domain admin rights; impact depends on the account's permissions (gbhackers.com).
  • Access vector context: CVE-2026-24858 (CVSS 9.4, FortiCloud SSO abuse) affects FortiOS, FortiProxy and FortiSwitchManager, with the Fortinet advisory dated 27 January 2026. Fortinet's June assessment also discusses credential reuse and brute force. The data does not establish a single initial-access mechanism, and the SSO bypass is background only (infostealers.com, gbhackers.com).
  • Attribution: Group-IB and NyxLab describe victim overlap with Qilin and The Gentlemen, but no affiliation is confirmed. NyxLab is credited with the foundational research on k0t (infostealers.com).

Remediação

  • Per Fortinet's guidance: end administrative and VPN sessions, reset credentials, enforce MFA, apply firmware updates and restrict management access (infostealers.com, gbhackers.com).
  • Review config system admin for unauthorized accounts (fgtsecure, fgtsec, Technical_support, forticloud-sync, forti-auth-tech, callcenter, my_admin, districtadmin, ftadm1n, super_admin) against ownership and configuration history (infostealers.com). Compare configurations against trusted backups (gbhackers.com).
  • Rotate LDAP bind secrets under config user ldap, plus exposed cluster and SMTP secrets, and update dependent services (infostealers.com, gbhackers.com).
  • Review firewall and domain controller logs for lateral movement (infostealers.com, gbhackers.com).
  • Hudson Rock offers a free lookup portal to check domain exposure (gbhackers.com).

Linha do tempo

  1. gbhackers.com ↗ · pub. 28/10/2026 09:19 · coletado 28/10 10:00

    Hudson Rock's FortiBleed 2.0 finds 40,573 cleartext secrets in leaked FortiGate configuration reports

    ler a análise desta fonte

    Hudson Rock published the FortiBleed 2.0 investigation on October 27, 2026. It analyzed 1,703 FortiGate configuration reports containing 101,419 credential and account records linked to 1,689 host identifiers, of which 40,573 records held cleartext secrets. The research also surfaces 975 domain labels missing from the earlier FortiBleed dataset, but these are not 975 newly confirmed breaches. Most dated reports carry February 20, 2026 timestamps, which describe the reports rather than verified compromise dates. Exposed secrets do not equal working access, and no single entry method has been established for every host.

    Technical Details

    • Cleartext records: 37,076 local-user entries, 1,576 Active Directory LDAP bind entries, 1,672 administrative logins, 144 high-availability cluster secrets and 105 SMTP credentials.
    • 7,437 cleartext local-user records are marked disabled. "Verified" admin logins reflect the source dataset, not fresh authentication tests, and blank MFA fields do not prove MFA was disabled.
    • Of the 1,689 host identifiers, 924 were absent from FortiBleed 1.0. Researchers found 1,453 domain labels, 975 of them absent from the earlier set. Some labels may identify service providers or email services rather than victims.
    • The reported toolchain parses configurations for local users, admin entries, LDAP settings, cluster secrets and email credentials. Other tools attempt VPN access with eligible accounts and check internal systems. Success depends on account status, network reachability, VPN rules and MFA.
    • Some FortiOS secrets use reversible encryption. Where the system-default key is used, values can be recovered offline. Device-specific keys change that risk.
    • An exposed LDAP bind password does not automatically give domain admin rights. Impact depends on the account's permissions.
    • A FortiCloud SSO bypass report is given as related background only.

    Remediation

    • Per Fortinet's guidance: end administrative and VPN sessions, reset credentials, enforce MFA, update firmware and restrict management access.
    • Compare configurations against trusted backups and investigate unknown accounts.
    • Review firewall and domain controller logs for internal movement.
    • Rotate exposed LDAP, cluster and SMTP secrets and update dependent services.
    • Use Hudson Rock's free lookup portal to check domain exposure.
  2. infostealers.com ↗ · pub. 27/10/2026 09:28 · coletado 27/10 11:01 primeiro registro

    FortiBleed 2.0: Hudson Rock Analyzes February 2026 FortiGate Config Dump With 40,573 Cleartext Secrets Across 1,689 Hosts

    ler a análise desta fonte

    Hudson Rock published FortiBleed 2.0, a follow-up analysis of newly obtained FortiGate configuration reports tied to the actor known as k0t. The material comprises 1,703 source files and 101,419 credential and account records across 1,689 host identifiers. Of these records, 40,573 contain cleartext secrets, including 37,076 local-user records and 1,576 Active Directory LDAP bind records. Report timestamps fall on 20 February 2026, earlier than the likely May/June material in FortiBleed 1.0. The dataset adds 924 hosts (54.7%) and 975 domain labels (67.1% of the union) absent from the first dataset. Hudson Rock says the records measure recorded exposure, not confirmed internal compromise.

    Technical Details

    • Content: 101,419 records include SH2 (10,376), PB2 (2,676), AK1 (316) and generic FortiOS_Hash (631) hashes, plus 36,104 empty password fields. The data also has 208 HA records (144 cleartext), 176 SMTP records (105 cleartext) and 1,672 administrator-login rows labeled Verified_Active_Login (1,633 with super_admin). These are source labels, not fresh authentication tests.
    • Tooling: The workflow described around forti_parse.py extracts configs and secrets. vpn_checker.py with openconnect attempts VPN logins. NetExec (nxc) is used against internal systems. Configs using FortiOS's default key may permit offline recovery of ENC secrets.
    • Overlap with FortiBleed 1.0: Of 765 shared hosts, 524 of 766 admin logins (68.4%) match exactly. The other 242 use different admin usernames, such as fgtsecure (106 occurrences), Technical_support, callcenter, fgtsec and forticloud-sync. In 216 of those, the 1.0 username coexists in the earlier System Admin table.
    • MFA: Among local users, 4,114 records use fortitoken, 909 email, 18 fortitoken-cloud and 1 sms. A blank two_fa field (78,369 entries) is missing information, not a disabled setting.
    • Access vector context: CVE-2026-24858 (CVSS 9.4, FortiCloud SSO abuse) affects FortiOS, FortiProxy and FortiSwitchManager, with the Fortinet advisory dated 27 January 2026. Fortinet's June assessment also discusses credential reuse and brute force. The data does not establish a single initial-access mechanism. Group-IB and NyxLab describe victim overlap with Qilin and The Gentlemen, but no affiliation is confirmed. NyxLab is credited with the foundational research on k0t.
    • Caveats: Registration emails may belong to MSSPs or contractors rather than victims. 7,437 of the cleartext local-user records are marked disabled.

    Remediation

    • Apply Fortinet firmware updates, restrict management access, terminate sessions, reset credentials and investigate lateral movement.
    • Review config system admin for unauthorized accounts (fgtsecure, fgtsec, Technical_support, forticloud-sync, forti-auth-tech, callcenter, my_admin, districtadmin, ftadm1n, super_admin) against ownership and configuration history.
    • Rotate LDAP bind secrets under config user ldap, remove excessive privileges such as Domain Admins membership and review authentication logs.
    • Reset exposed local-user, HA, RADIUS and SMTP secrets, disable unused accounts and verify effective MFA on admin and VPN paths.
    • Check exposure via Hudson Rock's free domain lookup (Cavalier).