Mass Credential Theft Campaign Targets Exposed FortiGate and GlobalProtect Edge Devices

Security researchers have disclosed a large-scale campaign targeting internet-exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls/VPN gateways, according to reporting from The Hacker News. The investigation reportedly found that operators behind the campaign gained access to numerous organizations worldwide and, in some cases, attempted further compromise of victims after initial access. Over 70,000 credentials are said to have been exposed as a result.

Why It Matters

Firewalls and VPN concentrators sit at the network perimeter and are frequently exposed to the internet by design, making them a high-value target: a single compromised edge device can hand attackers a foothold inside an otherwise well-defended network, along with harvested credentials that enable lateral movement, account takeover, or resale to other threat actors. The scale described — tens of thousands of credentials and "numerous organizations worldwide" — suggests an opportunistic, broadly scoped campaign rather than a narrowly targeted intrusion, meaning any organization running exposed Fortinet or Palo Alto edge appliances should treat this as directly relevant.

What Defenders Should Do Now

• Inventory all internet-facing FortiGate and GlobalProtect devices and confirm they are fully patched and running supported firmware/software versions.
• Review administrative and VPN access logs for anomalous logins, especially from unexpected geographies, unusual times, or impossible-travel patterns.
• Rotate credentials and certificates associated with edge devices, and enforce MFA on VPN and firewall management access where not already in place.
• Hunt for signs of post-access activity such as new or modified admin accounts, unexpected configuration changes, or outbound connections from the firewall/VPN appliance itself.
• Restrict management interfaces to trusted networks only, and disable any unnecessary exposed services on these devices.

This is a developing story and the underlying technical details — including specific vulnerabilities exploited, if any, and attribution — have not been independently verified here. For the full report, see the original coverage at The Hacker News.