Inside the FortiBleed Open Directory: A Technical Analysis of What the Attacker Left Behind

MITRE Techniques

• [T1110.001] Password Guessing – Used in brute-force and password-spraying activity against exposed devices and internal accounts (‘brute force’ and ‘spray_admin.sh run Kerberos and SMB password spraying against internal domain controllers’).
• [T1110.002] Password Cracking – Used offline hash cracking against captured credentials to build a validated dataset (‘offline hash cracking against exposed devices’ and ‘hashes were cracked on a ~45-GPU Hashtopolis cluster’).
• [T1595.001] Active Scanning – Used scanners to locate exposed FortiGate interfaces and other web logins (‘scanning located exposed FortiGate interfaces’ and ‘the scanners that found targets’).
• [T1210] Exploitation of Remote Services – Used working credentials and exposed management interfaces to access devices and pivot into victim networks (‘validated credentials were used to pivot into networks’ and ‘live SSL VPN configuration file pointing into a victim network’).
• [T1078] Valid Accounts – Leveraged stolen or reused device credentials for authenticated access (‘a verified dataset of working device credentials’ and ‘validated credentials’).
• [T1003.003] OS Credential Dumping: NTDS – Captured Kerberos-related authentication material and internal AD data from compromised environments (‘Kerberos pre authentication data’ and ‘captured from inside their networks’).
• [T1087.002] Domain Account Discovery – Enumerated Active Directory objects and admin-related accounts (‘enumerate internal Active Directory environments over LDAP — pulling domain administrators’).
• [T1046] Network Service Discovery – Tested SMB access and spidered network shares as part of internal reconnaissance (‘test SMB access and spider network shares’).
• [T1021.001] Remote Services: Remote Desktop Protocol – No direct RDP evidence was described; not included.
• [T1589.001] Gather Victim Identity Information: Credentials – Collected and organized credentials, email domains, and registration details for attribution and targeting (‘credential database text file maps each device login to a brand domain’ and ‘contact email supplied at FortiGuard registration’).
• [T1566] Phishing – Not mentioned in the article; not included.
• [T1105] Ingress Tool Transfer – Deployed tooling and scripts on exposed infrastructure, including automation and cracking components (‘tooling, automation scripts, connection strings, scheduled jobs’).