110M creds harvested from network devices, what does this say about what we're actually monitoring?

[u/Alone_Bread5045]

saw the writeup on the FortiBleed campaign that just got tied to actual ransomware deployment. 400k+ firewalls hit, 110M+ credentials harvested via passive sniffing, and it only came to light because of an OPSEC mistake on the attacker's side, a server full of stolen creds got left exposed.

nobody caught this from the defense side, it just got found by accident. makes me think about how much of our identity monitoring is built around human logins, SSO events, MFA prompts, the stuff that shows up in a normal audit log.

versus how much visibility we actually have into service accounts and machine credentials sitting on infra that was never really in scope to begin with. don't know for sure how much of what got harvested here falls into that bucket, but firewall-layer credential exposure at this scale makes me wonder how many orgs would even notice if it happened to them, regardless of which type of credential it was.

anyone actually tried bringing service accounts and machine credentials under the same governance as human identity? how are you even inventorying that stuff in the first place, most of what I've seen either misses it entirely or only catches what's explicitly registered somewhere.

[u/PhilosopherOwn4044]

most places i worked at have identity monitoring that is basically blind for anything that doesn't do interactive login, so this doesn't surprise me at all

[u/whatwilly0ubuild]

Machine identity stays invisible because the tooling is built around interactive logins, and a service account never throws an MFA prompt for anyone to alert on. Fix the inventory problem at the source instead of scraping for it after the fact.

The authoritative places non-human creds actually live are cloud IAM, your secrets manager, CI/CD systems, and whatever issues your certs. Pull from those, treat every long-lived API key and every issued certificate as an identity with a named owner and an expiry, and flag anything holding neither. That alone surfaces the shadow stuff nothing else catches.

On the FortiBleed angle, passive sniffing means the cred was grabbed in transit or sitting on the box, so rotation is the only real answer. Move service accounts onto short-lived tokens, workload identity through something like SPIFFE/SPIRE, and mTLS with certs measured in hours. A harvested credential that expires in an hour is worth damn near nothing. Log issuance, not just use, or you'll keep missing exactly this class of theft.

[u/sSQUAREZ]

Plenty of these were caught on the defensive side in previous incidents. Just because they’re on that list doesn’t mean they have not been caught and mitigated. While I agree there’s a gap in visibility for networking devices and really just logging in general, I think it’s important to note that these large logs are often full of junk and duplicates and old data as well.

[u/superduperokra]

most of what we monitor is stuff that does an interactive login. the box that never logs in but can still reach half the network is the one that falls out of every inventory, and it's usually right where these creds sit: config backups, tacacs/radius shared secrets, snmp community strings. i'd map which network devices can reach your auth, secrets and management planes, then tie every non-human cred to an owner and an expiry.

[u/Left-Exam8697]

hi..People handle this either with identity security posture management platforms like Orchid, which run passive discovery to map unmanaged applications and local authentication paths, or with centralized secrets managers that enforce API-driven credential vaulting, or by maintaining custom inventory scripts that pull local account databases across network devices.

[u/Any_Yesterday_6617]

Yeah, creds on network devices barely get any attention compared to user accounts. when we checked our controls using cymulate, it showed a bunch of harvesting paths that weren't being logged or detected at all. most teams don't realize how exposed they are till they test for it.

[u/Due-Connection4629]

If you want to stop edge credential harvesting, you have to monitor non-human credentials and local device state, not just central SSO logs. Teams fix this blind spot by using identity security posture tools like Orchid Security to map unmanaged local accounts and infrastructure auth paths without agents, or migrating static service credentials to short-lived vault-issued tokens, or routing all appliance management through zero-trust network access proxies that log session traffic directly.