Companion Detection Brief to the three-part report FortiBleed from the Target Side . TLP:CLEAR. For FortiGate operators and SOC teams. The full analysis is in Part 1: The Corpus , Part 2: The Ecosystem and Part 3: What Stops Them .
For: FortiGate operators, SOC and MSSP teams. Scope: the credential-validation phase only — the spray that tests which stolen passwords still work, not the original exploitation.
What you are detecting
The credential-validation phase of the FortiBleed campaign: automated tools spraying leaked, real corporate credentials at FortiGate POST /logincheck (HTTPS management, 443) to find which still work. The operators validate and leave — repeated steady-cadence failures from one source, occasionally a single success, then nothing. Multiple independent operators run the same stolen corpus in parallel from small bullet-proof-hosting allocations.
Highest-signal detections
- Admin login (success or failure) from a source IP outside your management allowlist. The single most valuable rule (see callout above).
- One source IP, many distinct usernames, short window. A single IP trying more than a few distinct usernames within an hour is a spray. Validation clusters run a low, steady cadence (about 2-minute inter-attempt) 24/7 with no time-of-day pattern.
- A single success after a run of failures from the same source. Treat as compromise until proven otherwise; begin credential rotation immediately.
- FortiGate service / cloud accounts appearing in failed logins (FortiCloud registration tokens, TAC support accounts, integration service accounts). Their appearance at the login prompt means a config backup of some device is in circulation — and the sprayer is testing whether it is yours.
Network indicators
The ASN-only network indicators observed during the window are tabulated in Part 3, §Indicators of compromise (per-CIDR ranges are held in the restricted edition). Operators migrate; pair the static ASN list with the behavioral rules above — and remember the report’s central warning: roughly half the effective sprayer IPs carried a threat score of zero, so a blocklist alone is not enough.
Observed surfaces (from 30 days of honeypot telemetry)
| Surface | Observation | SOC reading |
|---|---|---|
POST /logincheck | ≈447,600 events, core validation surface | Primary signal. HTTP 200 on both success and failure — do not use status code as verdict. |
GET /remote/login | 1,112 hits in recon; 284 IPs overlap with sprayers | SSL-VPN alternate auth. Good correlation pivot with /logincheck. |
POST /api/v2/authentication | 2 hits, both from sprayer IPs | Marginal REST auth probe, not exploitation. |
/api/v2/monitor/system/config/backup?scope=global | 3 GETs, all 401, no sprayer overlap | High-severity in production — but not observed as post-auth exploitation in this slice. |
/api/v2/monitor/system/debug?vdom=root | 976 POSTs, 2 IPs with sprayer overlap | Qualify carefully; may be noise/API/QA depending on context. |
/, favicon, .env, .git/config | High volume, very low sprayer overlap | Generic internet scanners, not the FortiBleed core. |
Operational summary: the primary signal is a direct POST /logincheck flow, often without preceding GET /, without favicon, without SPA navigation and without client-side product verification. The rare off-login requests target only other authentication surfaces.
The action that actually fixes it
Detection is the backstop. The fix is: (a) MFA on the management interface, which defeats credential spraying outright; (b) remove management from the internet (management VPN / trusted-host allowlist); (c) rotate every secret stored in the device config, not just admin — local users, service accounts, FortiCloud tokens, RADIUS/LDAP secrets. Patching the original CVE does not retract credentials already extracted from a pre-patch config.
MITRE ATT&CK
T1190 (upstream) · T1110.004 Credential Stuffing · T1078.001/.003 Valid Accounts. FortiCloud/config tokens appear as credential artifacts submitted to the FortiGate login, not as observed cloud-service access (hence no T1078.004).
OHIIHO Research tracks targeted threat campaigns and APT-grade attackers through high-intensity, intelligence-grade honeypot infrastructure worldwide. Contact: research@ohiiho.com .