FortiBleed — FortiGate Leaked-Credential & Config Intrusion HuntPack

CVE-2026-24858 ("FortiBleed") is a FortiCloud SSO authentication bypass (CWE-288, alternate path/channel; CVSS 9.4) disclosed by Fortinet on 2026-01-27 and added to the CISA KEV catalog the same week. When FortiCloud SSO admin login is enabled, an attacker holding any FortiCloud account with a registered device could authenticate to other tenants' FortiOS / FortiProxy / FortiManager / FortiAnalyzer / FortiWeb devices. Fortinet briefly disabled FortiCloud SSO globally (Jan 26) and re-enabled it with a fix on Jan 27; patched FortiOS builds are 7.4.11 and 7.6.6.

In mid-June 2026 (major disclosure 2026-06-17/18) a dataset of validated administrator and SSL-VPN credentials plus full configuration exports for 73,932 unique FortiGate URLs across 194 countries began circulating in cybercriminal communities. Researchers (Hudson Rock, Kevin Beaumont) estimate ~75,000 distinct devices — roughly half of internet-facing FortiGates on Shodan — with 30,000+ verified-working admin credentials. The presence of internal email addresses and data "only found inside device config exports" points to configuration-level exfiltration, not mere login-screen credential scraping.

The active threat right now is not the CVE itself — it is adversaries logging in with leaked, valid admin/VPN credentials and using stolen configs as a blueprint for follow-on intrusion. Because the credentials are valid, exploitation looks like normal authentication; detection must be behavioral. The highest-value defensive signals live in two places: (1) FortiGate's own event log — admin logins from unexpected ASNs/geographies, new local/SSO admin-account creation, config downloads, and SSL-VPN policy edits; and (2) CrowdStrike endpoint telemetry on the internal hosts an attacker reaches after VPN access — credential-access tooling, internal discovery scanners, and lateral RDP/SMB sourced from VPN client pools.

Defender priority: Treat every internet-facing FortiGate as credential-compromised until proven otherwise. Rotate ALL admin + local VPN credentials and the device config secrets (PSKs, API keys, LDAP/RADIUS binds) — patching alone does NOT invalidate already-leaked credentials. Then hunt FortiGate audit logs for new-admin-account creation (logid 0100044547 action=Add cfgpath=system.admin) and anomalous admin/VPN logins, and pivot to endpoint telemetry for post-VPN lateral movement.

IOC provenance note: No vendor or researcher has published FortiBleed-attributed atomic IOCs (no campaign IPs/domains/hashes tied to the leaked dataset). Atomic indicators circulating in some reporting (e.g. specific source IPs, the openmail.pro domain, mimikatz / Advanced IP Scanner) belong to the related but distinct CVE-2025-59718 FortiCloud-SSO intrusions investigated by Rapid7 — they are not attributable to the FortiBleed dataset and are deliberately excluded from this pack's IOC table. This pack is intentionally behavioral / log-based. Every detection below traces to an official FortiOS log-field definition or a documented TTP; none rely on invented indicators.

Carry-forward decision: Build a behavioral pack. Tier-1 Fortinet log-reference fields anchor the native FortiGate hunts; Rapid7 supplies the post-access TTP shape (lateral movement, discovery, credential access) for the CrowdStrike endpoint hunts — but only as behaviors, never as atomic indicators.

Hunt hypotheses (ordered by fidelity)

1. H1 (high): An attacker created a new FortiGate admin account for persistence — visible as logid 0100044547 action=Add cfgpath=system.admin (and system.sso-forticloud-admin) in FortiGate event logs forwarded to NG-SIEM.
2. H2 (high): A FortiGate device config was downloaded/exported by an admin session — "System config file has been downloaded by user … via GUI/API" — indicating exfiltration of the device blueprint.
3. H2b (medium): SSL-VPN / firewall config was altered post-access — edits to cfgpath=vpn.ssl.settings or firewall.policy (VPN enabled, new port-forward, logging disabled).
4. H3 (medium): Admin or SSL-VPN logins originate from anomalous ASNs/geographies — hosting/VPS/residential-proxy ranges, off-hours, or impossible-travel relative to the device's normal admin sources.
5. H4 (high): After VPN access, an internal endpoint runs credential-access tooling (LSASS access / Mimikatz-class behavior) sourced from the VPN client IP pool.
6. H5 (medium): A VPN-sourced host performs internal discovery — network/port scanners (Advanced IP Scanner, advanced_port_scanner, nbtscan-class) or rapid SMB/RDP fan-out.
7. H6 (medium): Lateral movement from the VPN landing host — interactive RDP (T1021.001) or SMB admin-share writes (T1021.002) shortly after a new VPN tunnel comes up.
8. H7 (low): Leaked-credential reuse across the estate — the same VPN/local account authenticating to many internal hosts in a short window (credential-stuffing the blueprint).

Attack chain

No atomic IOCs for FortiBleed. No IP, domain, URL, or hash has been publicly attributed to the CVE-2026-24858 leaked-credential dataset by any cited source. Per this pack's provenance rule, nothing is fabricated and no indicators from the unrelated CVE-2025-59718 campaign are imported. The "indicators" below are behavioral / log-based — that is the hunt surface for valid-credential abuse.

If your own IR produces verified FortiBleed infrastructure (e.g. a confirmed exfil destination from your FortiGate logs), add it to the Falcon IOC-Management CSV in §10 with action=detect and a 6-month expiry — but only from first-party evidence, never from third-party recycling.

Prerequisite: Sections 8 (FortiGate-log CQL) assume FortiGate event logs are shipped to Falcon Next-Gen SIEM / LogScale. If they are not, start with §7 native FortiAnalyzer/FortiGate hunts and the §12 immediate hardening to enable log forwarding before the CQL hunts will return data.

Run these directly on the FortiGate CLI / FortiAnalyzer before (or alongside) shipping logs to Falcon NG-SIEM. Field names are from the Fortinet FortiOS Log Message Reference.

7.1 — New admin / SSO-admin account creation (persistence — top signal)

FortiAnalyzer log filter (Event > System):
  logid=0100044547 AND action=Add AND cfgpath=system.admin
  OR cfgpath=system.sso-forticloud-admin
FortiGate CLI:
  execute log filter category event
  execute log filter field logid 0100044547
  execute log display
Review every hit: cfgobj (new account name), user (who created it),
srcip (where from). Any account you cannot attribute to a change ticket
is a compromise indicator.

7.2 — Configuration download / export (blueprint exfiltration)

Search event log message text for:
  "config file has been downloaded"  (GUI / API / backup)
Correlate the user + srcip against your known admin sources.
A config download from an unfamiliar IP or outside change windows
= probable exfiltration of the device blueprint.

7.3 — VPN / firewall config tampering

  logid=0100044546 OR logid=0100044547
  AND (cfgpath=vpn.ssl.settings OR cfgpath=firewall.policy
       OR cfgpath=log.disk.setting OR cfgpath=log.syslogd.setting)
Flag: SSL-VPN newly enabled, new firewall policy / port-forward,
or logging disabled (defense evasion).

7.4 — Anomalous admin & SSL-VPN logins

Admin login:   logid=0100032001 (logdesc "Admin login successful")
                fields: user, ui, srcip
SSL-VPN up:    logid=0101039947 (action=tunnel-up, tunneltype=ssl-*)
                fields: user, remip
Hunt: srcip/remip in hosting/VPS/residential-proxy ASNs, off-hours,
or geographies that never administer this device (impossible travel).

FortiGate automation stitch: build an email/alert trigger on logid 0100044547 action=Add cfgpath=system.admin so new-admin creation pages the SOC in real time even before SIEM ingestion.

Q1–Q4 query FortiGate logs ingested into Falcon Next-Gen SIEM / LogScale (third-party repo); field names follow the FortiOS syslog key=value schema. Q5–Q7 query Falcon EDR endpoint telemetry on internal hosts. Adjust the FortiGate repo/parser field prefix to match your tenant's parser.

// HUNT: FortiGate new administrator account created (persistence)
// MITRE: T1136.001
// CONF: high  FP: low  COST: low | REQUIRES: FortiGate event log in NG-SIEM
// FALSE POSITIVES: sanctioned admin provisioning
// TUNING: exclude approved provisioning users / mgmt jump-host srcip
logid=/^0?100044547$/
| action=/^Add$/i
| cfgpath=/system\.(admin|sso-forticloud-admin)/i
| user!=/^(svc_change_mgmt|netops_provision)$/i
| table([@timestamp, devname, user, srcip, action, cfgpath, cfgobj, cfgattr, msg], limit=200)

// HUNT: FortiGate config file downloaded / exported
// MITRE: T1602.002
// CONF: high  FP: medium  COST: low | REQUIRES: FortiGate event log in NG-SIEM
// FALSE POSITIVES: scheduled config-backup jobs (FortiManager / cron)
// TUNING: exclude backup svc account + mgmt-station srcip
msg=/config file has been downloaded/i
| user!=/^(svc_backup|fortimanager)$/i
| srcip!=/^10\.(10|20)\./
| table([@timestamp, devname, user, srcip, ui, action, msg], limit=200)

// HUNT: FortiGate VPN/firewall/logging config tampering
// MITRE: T1562.001, T1602.002
// CONF: high  FP: medium  COST: low | REQUIRES: FortiGate event log in NG-SIEM
// FALSE POSITIVES: sanctioned netops config changes
// TUNING: exclude change-window users; join to ticketing if available
logid=/^0?10004454[67]$/
| cfgpath=/^(vpn\.ssl\.settings|firewall\.policy|log\.(disk|syslogd)\.setting)/i
| user!=/^(netops_change|svc_change_mgmt)$/i
| table([@timestamp, devname, user, srcip, action, cfgpath, cfgobj, msg], limit=200)

// HUNT: anomalous admin / SSL-VPN login source (valid-cred abuse)
// MITRE: T1078
// CONF: medium  FP: medium  COST: medium | REQUIRES: FortiGate event log in NG-SIEM
// FALSE POSITIVES: travelling admins, new remote-worker IPs
// TUNING: exclude corporate egress CIDRs; raise rarity threshold per env
logid=/^0?10(0032001|1039947)$/
| srcip := if(remip!="", remip, srcip)
| srcip!=/^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.)/
| groupBy([user, srcip], function=count(as=hits))
| timeChart(span=1d, series=srcip, function=count())
| sort([hits], order=asc, limit=200)
| table([user, srcip, hits], limit=200)

// HUNT: credential-dumping process on internal host (post-VPN)
// MITRE: T1003.001
// CONF: high  FP: medium  COST: medium | REQUIRES: Falcon EDR ProcessRollup2
// FALSE POSITIVES: signed security/backup agents reading LSASS
// TUNING: exclude vendor tool install paths (Program Files\<Vendor>)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(sekurlsa|logonpasswords|lsadump|procdump.*lsass|comsvcs.*MiniDump|nanodump)/i
| ImageFileName!=/\\Program Files\\(Windows Defender|CrowdStrike|Veeam)\\/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, SHA256HashData], limit=200)

// HUNT: internal discovery scanner execution (post-VPN)
// MITRE: T1046
// CONF: medium  FP: medium  COST: low | REQUIRES: Falcon EDR ProcessRollup2
// FALSE POSITIVES: sanctioned IT asset/vuln scans
// TUNING: exclude approved scanner hosts / service accounts
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/(advanced_?ip_?scanner|advanced_?port_?scanner|nbtscan|fscan|netscan|softperfect)/i
| UserName!=/^(svc_vulnscan|it_inventory)$/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName], limit=200)

// HUNT: RDP/SMB fan-out from single host (lateral movement)
// MITRE: T1021.001, T1021.002
// CONF: medium  FP: medium  COST: medium | REQUIRES: Falcon EDR NetworkConnectIP4
// FALSE POSITIVES: jump hosts, patch/mgmt servers, vuln scanners
// TUNING: exclude known admin/jump host aids; tune distinct-host threshold
#event_simpleName=NetworkConnectIP4
| in(RemotePort, values=[3389, 445])
| aid!=/^(JUMPHOST_AID_1|MGMT_AID_1)$/
| groupBy([aid, ComputerName], function=([count(RemoteAddressIP4, as=hosts, distinct=true), collect([RemotePort])]))
| hosts >= 10
| table([ComputerName, hosts, RemotePort], limit=200)

Promote the high-confidence, low-FP endpoint hunts to Custom IOAs (the FortiGate-log hunts Q1–Q4 belong in NG-SIEM scheduled searches, not endpoint IOAs).

Pilot every IOA in Monitor on a representative host group for 7–14 days; promote to Detect/Block only after the FP exclusions above are confirmed in your environment.

Behavioral pack — no atomic IOCs published. The CSV below ships with REPLACE_WITH_… placeholders only; populate it solely from first-party evidence (your own FortiGate logs / IR). Do not import third-party IPs/domains/hashes — none are attributed to FortiBleed.

type,value,action,severity,expiration,description,tags
ipv4,REPLACE_WITH_CONFIRMED_EXFIL_IP,detect,high,2026-12-21,FortiBleed exfil dest (first-party),campaign:FortiBleed
domain,REPLACE_WITH_CONFIRMED_C2,detect,high,2026-12-21,FortiBleed follow-on C2 (first-party),campaign:FortiBleed
sha256,REPLACE_WITH_CONFIRMED_TOOL_HASH,detect,critical,2026-12-21,post-access tool (first-party),campaign:FortiBleed
# Leave blank unless YOUR logs confirm it. No public FortiBleed IOCs exist.

new_admin      logid=0100044547 action=Add cfgpath=system.admin
sso_admin      cfgpath=system.sso-forticloud-admin
config_export  msg=~"config file has been downloaded"
vpn_tamper     logid=0100044546|47 cfgpath=vpn.ssl.settings|firewall.policy
log_disable    cfgpath=log.disk.setting|log.syslogd.setting action=Edit
admin_login    logid=0100032001  fields: user,ui,srcip
sslvpn_up      logid=0101039947  action=tunnel-up fields: user,remip

cred_dump   cmdline ~ sekurlsa|lsadump|comsvcs*MiniDump|nanodump  (T1003.001)
scanner     image  ~ advanced_ip_scanner|advanced_port_scanner|fscan  (T1046)
latmov      single aid -> >=10 hosts on 3389/445                      (T1021)
valid_acct  VPN login from new ASN/geo, off-hours, impossible-travel  (T1078)

Fixed FortiOS:     7.4.11  or  7.6.6  (verify build, not just branch)
Disable bypass:    config system global
                     set admin-forticloud-sso-login disable
                   end
Rotate (mandatory even if patched):
  - all admin passwords + API keys
  - all local SSL-VPN user passwords
  - IPsec/SSL PSKs, LDAP/RADIUS bind creds in the config
Restrict mgmt:     trusthosts on every admin; no mgmt on WAN/SSL-VPN port

13.1 — FortiGate: close the bypass, restrict admin, force MFA (FortiOS CLI)

config system global
    set admin-forticloud-sso-login disable
end
config system interface
    edit "wan1"
        unset allowaccess
    next
end
config system admin
    edit "admin"
        set trusthosts1 10.10.0.0 255.255.0.0
        set two-factor fortitoken-cloud
    next
end
# Rotate every local SSL-VPN user password:
config vpn ssl web user-bookmark
end
config user local
    edit "vpnuser1"
        set passwd ENC <NEW_STRONG_SECRET>
    next
end
# Verify patched build:
get system status | grep Version   # expect v7.4.11 or v7.6.6

13.2 — FortiGate: real-time alert on new-admin creation (automation stitch)

config system automation-trigger
    edit "new-admin-created"
        set event-type event-log
        set logid 44547
    next
end
config system automation-action
    edit "page-soc"
        set action-type email
        set email-to "soc@internal-host.example.com"
        set email-subject "FortiGate admin object change (logid 44547)"
    next
end
config system automation-stitch
    edit "alert-new-admin"
        set trigger "new-admin-created"
        set actions "page-soc"
    next
end

13.3 — Windows: block LSASS credential theft on VPN-reachable hosts (PowerShell / ASR)

# ASR: Block credential stealing from LSASS
Add-MpPreference -AttackSurfaceReductionRules_Ids `
  9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 -AttackSurfaceReductionRules_Actions Enabled
# Enable LSA protection (RunAsPPL) + Credential Guard via registry
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" `
  -Name "RunAsPPL" -Value 1 -PropertyType DWORD -Force
# Verify:
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name RunAsPPL

Pilot ASR rules in Audit mode first (-AttackSurfaceReductionRules_Actions AuditMode) to catch legitimate LSASS readers (backup/EDR agents) before enforcing.

Validation: Coverage is strongest on FortiGate audit-log persistence/exfil (Q1–Q3) and endpoint post-access (Q5). Weakest on the cloud SSO authentication step and the in-appliance exploit itself — both are mitigated by control (patch + disable SSO) rather than detected, and are explicitly flagged as gaps. Treat this as a valid-credential abuse hunt, not a malware hunt.

Provenance statement: This pack contains zero atomic IOCs. Every detection signature traces to an official Fortinet log-field definition (Tier 1) or a documented TTP (Tier 2). Indicators from the unrelated CVE-2025-59718 campaign were reviewed and deliberately excluded.