A coordinated campaign leveraged exposed enterprise firewalls from Fortinet and Palo Alto Networks, compromising more than 70,000 credentials and underscoring the rising risk to network edge infrastructure.
A coordinated cyber‑espionage campaign has exploited misconfigured firewalls from Fortinet and Palo Alto Networks, exposing more than 70,000 user credentials and highlighting the growing vulnerability of edge network devices.
How the Attack Unfolded
Threat actors scanned the public internet for firewalls that were left with default administrative passwords or outdated firmware. Once a vulnerable device was identified, the attackers leveraged known exploits to gain remote code execution, establishing a foothold within corporate networks.
Targeted Vendors and Their Role
Both Fortinet’s FortiGate and Palo Alto Networks’ Panorama appliances were affected. These products are commonly deployed at the network perimeter to enforce security policies, making them attractive targets for adversaries seeking to bypass traditional defenses.
- FortiGate devices with default credentials
- Panorama management consoles lacking recent patches
- Exposed management interfaces reachable from the internet
Impact on Compromised Accounts
After infiltrating the firewalls, the attackers harvested authentication tokens and password hashes from connected systems. The breach resulted in the exposure of over 70,000 user accounts, many of which belonged to employees of large enterprises and government agencies.
Security researchers recommend immediate remediation steps, including resetting all default passwords, applying the latest firmware updates, and restricting management access to trusted IP ranges.
For organizations looking to strengthen their edge defenses, uxc.news offers a deeper dive into network security best practices in the Technology section.
Read the full report on the incident at The Hacker News coverage of firewall breaches.
Track coverage on Momentum · More in Technology.