A hacking group claims to have stolen VPN passwords from customers of a well-known company. Specifically, the hackers appear to have published approximately 500,000 login credentialsbelonging to users of a popular VPN product from cybersecurity company Fortinet.
See also: Password attacks: Were you hacked and didn't "notice" it?
Attackers using the alias “Orange” leaked usernames and passwords on a dark web forum on Tuesday, according to a report by Bleeping Computer. Publishing stolen data is a common tactic among cybercriminals. Often, hackers sell the data to make money. However, this particular hacking group appears to be offering the passwords of Fortinet VPN users for free.
See also: Fortinet patches serious vulnerability in FortiManager and FortiAnalyzer
It is believed that the accounts were compromised through a vulnerability in the product. In April, federal agencies warned of several vulnerabilities in Fortinet's VPN that could allow hackers to access systems. The company has since issued patches to fix those vulnerabilities, but it appears that many users' accounts were compromised.
According to research by security firm Advanced Intel, the Orange group is believed to be a member of the “Groove” ransomware gang. Rumor has it that the hackers had previously worked for the Babuk ransomware, a dangerous ransomware gang that attempted to extort from a Washington, D.C., police department.
The Groove team recently launched a new forum called RAMP, and researchers believe the gang may have leaked Fortinet VPN passwords to draw attention to its new business venture.
VPNs are designed to protect users' confidential data and online activity. However, they can be a real nightmare if someone breaches them. In this case, accessing Fortinet VPN accounts would likely allow cybercriminals to infiltrate networks, steal data , and more. According to the criminals who leaked the VPN passwords, many of those credentials are still valid.
See also: DoubleVPN: Authorities shut down VPN service used by criminals
The credentials appear to be linked to 498,908 users and over 12,856 devices, from 74 different countries. The most Fortinet VPN passwords come from India. This is followed by Italy, France and Israel.
Source: Gizmodo
