Pierluigi Paganini
January 16, 2025
A previously unknown threat actor named Belsen Group published configuration files and VPN passwords for over 15,000 Fortinet FortiGate appliances.
“2025 will be a fortunate year for the world.
At the beginning of the year, and as a positive start for us, and in order to solidify the name of our group in your memory, we are proud to announce our first official operation:
Will be published of sensitive data from over 15,000 targets worldwide (both governmental and private sectors) that have been hacked and their data extracted.” reads the announcement published on the BreachForums forum.
“The data includes:
To make it easier for you, we have categorized the targets by country names.
And the biggest surprise: All this sensitive and crucial data is absolutely FREE, offered to you as a gift from the Belsen Group.”
According to Heise security, the published data doesn’t appear to be linked to recently published vulnerabilities in the FortiOS appliance operating system.
The analysis of the configuration files revealed that all the FortiOS versions in the data set were older than version 7.2.2, released in October 2022.
“The build date coded in the last number block also points to the same date range: None of the firewall firmwares examined had been compiled after September 14, 2022.” reported Heise Security.
“As many as 80 different device types can be found in the data leak, with the FortiGate Firewall 40F and 60F being the most widespread. There are also WLAN gateways and devices for installation in the server rack as well as compact devices for the desk or broom cupboard.”
These findings suggest that the data was likely stolen in the fall of 2022, but it’s unclear how attackers have obtained this information. A configuration file includes the line “Exploiting target: IP:Port,” suggesting the attackers exploited individual firewalls. We can exclude the circumstance that the attackers may have compromised Fortinet.
The majority of devices included in the data leak are located in Mexico (1,603), the USA (679), and Germany (208). Many of the exposed IP addresses belong to major providers such as Deutsche Telekom, Vodafone, and other major internet service providers.
FortiNet has yet to comment on the case.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Fortinet)
