Fortinet and Palo Alto in the crosshairs: 70,000 credentials exposed

The perimeter, once again at the center of the target

Network edge devices —firewalls and VPN concentrators— have become a recurring target for attackers. The news published by The Hacker News describes a large-scale campaign directed against exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect equipment. According to the researchers, the artifacts of the incident indicate that the operators have obtained access to numerous organizations worldwide and have attempted to further compromise some victims. The most striking figure: more than 70,000 credentials may have been exposed.

This is not an isolated flaw nor necessarily a zero-day exploit. The key lies in exposure: administration services and VPN portals accessible from the Internet, often with weak configurations or reused credentials. Attackers do not need a sophisticated vulnerability if they find an open door with a predictable lock.

What it means for an SME

For an SME, the firewall and the VPN are not just infrastructure: they are the gateway to the corporate network and, often, the only perimeter control available. If an attacker obtains valid credentials from a VPN user, the rest of the internal defenses can be left in the background. Many small businesses do not have a 24/7 SOC or visibility into failed authentication attempts on their edge devices. That blindness is precisely what a campaign of this type takes advantage of.

The potential impact includes access to internal systems, lateral movement, information theft and, in the worst case, ransomware deployment. You do not need to be a big target: attackers automate scanning and credential testing at scale. The question is not whether your IP will appear in a sweep, but when.

Concrete recommendations for IT teams

Faced with a campaign of this nature, the response must be immediate and based on well-executed basic hygiene. These are the actions we recommend at ForgeNEX:

• Inventory and exposure: identify all firewalls and VPN portals accessible from the Internet. Check whether the administration interface is exposed and restrict its access to trusted addresses or to an administration VPN.
• Credentials: force a password change on all VPN and administration accesses. Remove orphaned or shared accounts. Enable multi-factor authentication (MFA) on all remote accesses, without exceptions.
• Patching: apply the manufacturer's updates. Although the news does not detail a specific vulnerability, edge devices accumulate critical CVEs frequently. Keep a patching schedule and verify the version in use.
• Monitoring: review logs of failed authentication and connections from unknown IPs. Configure alerts for spikes in login attempts or access outside business hours.
• Segmentation: do not allow a VPN access to grant visibility and access to the entire network. Apply segmentation and the principle of least privilege.
• Response plan: if you detect signs of compromise, isolate the device, rotate credentials and review the scope before reconnecting.

This incident reinforces an idea we have already discussed on the blog: static credentials remain a weak point. As we commented in Vercel wants to kill static credentials, but its own token is still alive, eliminating permanent secrets is a goal, but operational reality demands compensating controls while we coexist with them. Likewise, device and configuration management —as we proposed in Linux reaches the developers' desktop: the challenge is managing it— requires inventory, policies and visibility; without that, any brute-force or credential-reuse campaign finds fertile ground.

ForgeNEX's analysis

The campaign described is not an isolated incident, but a reminder that the perimeter remains the most fragile point for many SMEs. The combination of exposed devices, weak credentials and lack of MFA is a perfect storm. Having a firewall is not enough: it must be managed, updated and monitored. For IT teams with limited resources, the priority must be to reduce the exposure surface and secure remote access. A quick audit of VPN accesses and administration panels can make the difference between being one more victim or staying off the radar. At ForgeNEX we recommend approaching this as a continuous hygiene project, not as a one-off reaction.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.