Researchers Uncover Massive Credential Leak via Compromised Enterprise Firewalls and VPNs

Cybersecurity analysts have revealed a large‑scale intrusion campaign that has siphoned more than 70,000 usernames and passwords by exploiting publicly exposed network edge devices, including Fortinet FortiGate firewalls and Palo Alto Networks GlobalProtect VPN gateways.

The operation appears to rely on automated scans of the public internet to locate firewalls that are either misconfigured or still using default login details. Once a vulnerable appliance is identified, attackers gain foothold, often leveraging known software flaws or simple credential‑stuffing attacks to establish a persistent presence.

Detailed forensic work shows a systematic focus on the two vendors’ flagship products. In many instances, the threat actors used the same exploitation patterns across dozens of organizations, suggesting a coordinated effort rather than isolated opportunistic breaches. The harvested credentials were then aggregated, providing the attackers with a pool of valid accounts that can be used to move laterally within corporate networks.

Security experts warn that the exposure of such a volume of credentials could enable a range of follow‑on attacks, from data exfiltration to ransomware deployment. Because firewalls and VPNs sit at the boundary between external traffic and internal resources, compromised devices can serve as launch points for deeper infiltration, bypassing many traditional security controls.

In response, the research community is urging organizations to conduct immediate audits of their perimeter devices, enforce multi‑factor authentication, apply all vendor‑released patches, and monitor for anomalous login activity. Vendors have also issued advisories reminding customers to disable unused services and to replace default passwords with strong, unique credentials.

Analysts predict that attackers will continue to target edge infrastructure as remote work and cloud adoption expand the attack surface. Ongoing collaboration between security researchers, vendors, and enterprises will be critical to detect and mitigate similar campaigns before they can harvest additional credentials.