Hackers claim to have access to cracked Fortinet systems. They offer this access for sale online.

On the dark web, criminals sell access to Fortinet devices from various companies. Based on a sample of the data, Daily Dark Web has found that the hackers primarily have access to smaller companies, although they claim that larger organizations are also being targeted. Access is sold bundled per region, with no information about what exactly you are purchasing per region.

Details are scarce. It is unclear who is behind the sale of the access data and how it was obtained. There’s a good chance that a previously discovered vulnerability is the cause. There is no indication that Fortinet devices are vulnerable to a new zero-day flaw, but there are still many customers who have not sufficiently patched their hardware to address the latest vulnerabilities.

Developed ecosystem

It is not uncommon for access to be sold via the dark web following a successful hack. Cybercrime is now a very developed sector with different actors, each with their own specialization. Anyone who gains initial access is not necessarily interested in exploiting it. The revenue model then consists of selling this access to other criminals who want to start running ransomware, for example.