Coordinated Brute Force Campaign Targets Fortinet SSL VPN | Grey Noise

Summary: On August 3, GreyNoise observed a spike in brute-force traffic against Fortinet SSL VPNs, with over 780 unique IPs triggering its Fortinet SSL VPN Bruteforcer tag in a single day, the highest single-day volume on that tag in recent months. GreyNoise reports that spikes on this tag correlate with future disclosed Fortinet vulnerabilities, often within six weeks, and that traffic from August 5 onward shifted from the FortiOS profile to the FortiManager FGFM profile while still triggering the same tag.
Key Takeaway: GreyNoise's own data ties spikes on this exact tag to Fortinet CVE disclosures within roughly six weeks, so a single-day high of 780-plus IPs is a leading indicator a Fortinet-dependent security team should weigh now rather than after the advisory lands.

Read the original at GreyNoise Blog ↗