On August 3, 2025, GreyNoise detected a record spike in brute-force attacks targeting Fortinet SSL VPNs, with over 780 unique IPs flagged in a single day. Historical data shows such spikes often precede disclosure of Fortinet vulnerabilities – 80% within six weeks.
Severity Level: High
Incident Summary
- Initial Spike (August 3, 2025): Attack traffic focused on FortiOS profiles, characterized by one dominant TCP signature.
- Evolution (August 5, 2025 onwards): Sudden shift to a different TCP signature, paired with distinct client signatures, indicating a new operational phase. Targeting pivoted from FortiOS to FortiManager (FGFM) services.
- Geographic Hotspots: Hong Kong and Brazil emerged as top targeted countries over the past 90 days.
Attack Waves Identified
- Wave One – Long-Term Campaign:
- Steady brute-force attempts with a consistent TCP signature.
- Likely operated by an established threat infrastructure.
- Wave Two – Coordinated Burst:
- Began August 5, featuring a completely different TCP signature.
- Associated with both VPN and FortiManager targeting, possibly using the same underlying tools.
Infrastructure Notes
- One FortiGate device linked to a residential ISP (Pilot Fiber Inc.) appeared in testing or early deployment, suggesting possible residential proxy use or pre-campaign staging.
- IP overlap between the August 3 spike and historical activity hints at toolset reuse or shared operator infrastructure.
Risk Correlation
- GreyNoise research shows 80% of similar brute-force traffic spikes against Fortinet precede vulnerability disclosures for the same products within six weeks.
- This increases the urgency for proactive defense before potential exploitation of a zero-day or newly disclosed flaw.
Recommendations
- Restrict VPN access from high-risk or non-business regions.
- Implement authentication rate limits for VPN services to slow down brute-force attempts.
- Enforce MFA for all VPN and FortiManager accounts, especially administrative users.
- Ensure Fortinet SSL VPN and FortiManager are running latest security patches.
- Track Fortinet security bulletins closely over the next six weeks for potential related CVE disclosures.
- Monitor for unusual login activity, such as high-frequency login failures or access from atypical geolocations.
- Block the IOCs at their respective controls
https://www.virustotal.com/gui/collection/5f282a08f09835dba790cf4b6b4cab76c9486aa11514405501e491397a734c0a/iocs
Source:
- https://www.greynoise.io/blog/vulnerability-fortinet-vpn-bruteforce-spike
- https://viz.greynoise.io/tags/fortinet-ssl-vpn-bruteforcer
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.