This threat brief details a multi-stage credential attack campaign observed by Unit 42 involving password spraying against internet-exposed Fortinet, Sophos, and MSSQL services. The attackers leverage a curated password list compiled from prior breaches and exploit privilege escalation vulnerabilities to extract device configurations containing credentials. Offline cracking of stolen credentials feeds back into the password spraying efforts to compromise additional targets and establish persistent administrative access. An initial access broker claimed responsibility on a Russian-language cybercrime forum, referencing an unspecified CVE and offering stolen credentials for sale, though Unit 42 has not validated these claims. Palo Alto Networks provides guidance on auditing remote access logs, enforcing MFA, adopting zero trust principles, changing default credentials, disabling unused accounts, and applying patches to mitigate this threat. The brief emphasizes that Palo Alto Networks devices have not been targeted but customers should remain vigilant and apply recommended protections.

The campaign enables threat actors to gain persistent, high-privilege access to targeted network devices by password spraying and exploiting privilege escalation vulnerabilities. This can lead to unauthorized access to device configurations and credentials, facilitating lateral movement and further compromise. While Fortinet, Sophos, and MSSQL devices are targeted, Palo Alto Networks devices have not been directly affected according to current telemetry. The compromise of credentials and device configurations increases the risk of network breaches and potential data exposure.

Unit 42 recommends auditing remote access logs for suspicious successful logins following password failure events. Customers should implement strong phishing-resistant multi-factor authentication (MFA) for all remote services, adopt zero trust architecture to prevent direct internet exposure of management interfaces, change default credentials to complex passwords, and onboard accounts to privileged access management (PAM) with automated password rotation. Disabling unused accounts and applying the latest patches to address known vulnerabilities, including privilege escalation flaws, are also advised. Palo Alto Networks customers benefit from integrated MFA platforms, customizable password profiles, and best practices for administrative access. No confirmed patch status is provided for the referenced CVE; users should monitor vendor advisories for updates.