Massive Brute Force Attack Campaign Targets Fortinet SSL VPNs Worldwide
Security Researchers Document Coordinated Brute Force Activity Against Fortinet SSL VPN Devices – Cybercriminals Execute Multi-Phase Attack Strategy With Custom Tools And Advanced Planning
A coordinated brute-force wave hit Fortinet SSL VPNs, then pivoted to FortiManager. Here is why it matters - and the checklist to harden your defenses now.
A brute-force spike against Fortinet VPNs is not just noise - research shows it is often the opening move before a new vulnerability is disclosed.
Brute-force attacks - automated guessing of usernames and passwords - are constant background noise on the internet. What made this one notable was its scale, its precision, and its timing. When hundreds of IP addresses suddenly focus on one vendor's product in a coordinated way, security researchers have learned to treat it as an early warning. For any business running Fortinet remote access, that warning is worth acting on before the exploit arrives.
What Happened
A one-day surge, then a telling shift in target.
Over 780 IPs brute-forced Fortinet SSL VPNs on August 3, then the same activity moved to FortiManager two days later.
The traffic specifically targeted the FortiOS profile - a sign of deliberate aim, not opportunistic scanning. The attacking IPs traced to the United States, Canada, Russia, and the Netherlands, and the targets spanned the United States, Hong Kong, Brazil, Spain, and Japan. Then the operators shifted to FortiManager, the platform that centrally manages many Fortinet devices at once - a far higher-value target than any single VPN.
Why It Is a Warning Sign
The login attempts matter less than what they usually precede.
Coordinated spikes against one vendor often signal that an exploit is coming - and FortiManager is the keys to the kingdom.
- Spikes predict CVEs. GreyNoise found that a surge like this is followed by a disclosed vulnerability for the same vendor about 80% of the time, within six weeks - so it reads as reconnaissance.
- FortiManager raises the stakes. It centrally manages many devices, so compromising it could hand an attacker control of an entire fleet at once.
- The precision signals resources. Coordinating hundreds of IPs against a specific product profile points to an organized, well-funded operation rather than a lone opportunist.
- Remote access is the prize. VPNs sit at the edge of the network with a direct path inside, which is exactly why attackers keep hammering them.
None of this means a breach is inevitable. It means the window to harden your Fortinet devices is open now, before any new vulnerability is weaponized.
Your Fortinet Hardening Checklist
Work through these now - they protect against both the brute force and a future exploit.
Restrict who can reach the VPN, require MFA, patch fast, and watch the logs.
- Enforce MFA on every VPN account. Multi-factor authentication defeats brute force outright, even against a correct password.
- Restrict access with IP allowlisting. Limit VPN and FortiManager access to known, trusted networks and block high-risk regions.
- Patch on an emergency footing. Apply Fortinet security updates immediately - if a CVE follows this spike, speed is everything.
- Monitor authentication logs. Alert on repeated failed logins and unusual geographic access to VPN and FortiManager.
- Segment the network. Isolate what VPN users can reach so a compromised session cannot move freely.
- Lock down FortiManager. Treat management platforms as crown jewels - restrict access, log everything, and require MFA.
- Test your incident response plan. Have credential-revocation and isolation steps ready before you need them.
Running Fortinet VPN? Get Ahead of the Next CVE.
CinchOps reviews your Fortinet configuration, enforces MFA and access controls, and monitors for the login patterns in this campaign - before a vulnerability lands.
Talk to CinchOpsThe brute-force attempts are the least of it. What matters is the pattern: when attackers gang up on one vendor's product like this, a vulnerability disclosure tends to follow within weeks. That is a gift, really - a warning to patch and harden before the exploit shows up. Waste it and you are the test case.
Harden Your Remote Access Before the Exploit
CinchOps hardens and monitors Fortinet VPN and FortiManager - MFA, access controls, emergency patching, and log monitoring - as part of our cybersecurity and managed IT services.
Explore CinchOps cybersecurity →How CinchOps Helps Secure Your Business
CinchOps is a Katy, Texas managed IT services provider serving businesses across the Houston metro, hardening the remote-access devices attackers target first.
- Fortinet configuration review. Finding weak settings and exposure across your VPN and FortiManager.
- MFA and access hardening. Multi-factor authentication and allowlisting on every remote-access account.
- Emergency patch management. Fast application of Fortinet security updates when a CVE lands.
- 24/7 monitoring. Alerting on brute-force patterns and unusual VPN access.
- Segmentation and incident response. Limiting blast radius and a tested plan to revoke and isolate quickly.
Do not wait for the CVE to catch you unprepared. Contact CinchOps to harden your Fortinet remote access.
Frequently Asked Questions
What happened in the Fortinet SSL VPN brute-force campaign?
On August 3, 2025, GreyNoise recorded more than 780 unique IP addresses brute-forcing Fortinet SSL VPN logins in a single day - a deliberate, coordinated spike. Two days later, the same activity pivoted to FortiManager, Fortinet's centralized management platform.
Why is a brute-force spike a warning sign?
GreyNoise research found that coordinated spikes against a specific vendor are followed by a disclosed vulnerability for that vendor about 80% of the time, within six weeks. The activity often functions as reconnaissance before an exploit is released.
What is FortiManager, and why does it matter here?
FortiManager is Fortinet's platform for centrally managing many devices at once. Because compromising it could give an attacker control over an entire fleet, the pivot from single VPNs to FortiManager marked a significant escalation.
How do I protect my business from this?
Enforce MFA on all VPN accounts, restrict access with IP allowlisting, patch Fortinet devices immediately, monitor authentication logs for failed and unusual logins, segment the network, and lock down FortiManager. The checklist above covers each step.
Does MFA really stop brute-force attacks?
Largely, yes. Brute force works by guessing passwords, so requiring a second factor means a correct password alone is not enough to log in. MFA is the single most effective control against this class of attack.
Discover More
Sources
