Council login details thought to be stolen in Russian cyber attack

According to a report in the Telegraph newspaper, a list of compromised accounts it had seen included credentials belonging to local government officials, the NHC and even IT staff at British embassies in Thailand and Mauritius.

It also reported that compromised credentials are being offered for sale on dark web forums for as much as $60,000 (£44,000) and said the breach also affected overseas Foreign Office staff, NHS organisations and other critical infrastructure.

Multiple industries - including government services - around the world fell victim to the attacks, according to an investigation by cyber security firm SOCRadar.

The National Cyber Security Centre (NCSC) has since warned organisations using Fortinet firewalls and VPN gateways to carry out checks on their devices and factory reset any devices they believe have been compromised.

Describing the attack, the national cyber watchdog said the programmes had been targeted as part of a global campaign, with some indications of potential impact in the UK.
It added: "A database of credentials has been leaked by a threat actor following brute-force, dictionary and credential stuffing attempts against internet-facing FortiGate and VPN portals.

"Credential stuffing is a method where attackers use passwords stolen from one web service to try to access accounts on other services, taking advantage of any reuse of username and password combinations."

The NCSC recommended UK organisations using Fortinet edge devices with SSL VPN enabled to investigate potentially malicious activity on the device and monitor their network for unusual activity.

It has set out a nine step-approach on its website: https://www.ncsc.gov.uk/news/advice-following-global-targeting-of-fortinet-firewalls-and-vpn-gateways

Adam Carey