FBI Issues Alert on Persistent FortiBleed Campaign Targeting FortiGate Devices
The FBI has issued a warning about an ongoing cyberattack campaign known as FortiBleed, which continues to target exposed Fortinet FortiGate firewalls and SSL VPN gateways. According to the alert, attackers are successfully locking out legitimate administrators by exploiting previously leaked credentials and other stolen login information.
The attack chain begins with threat actors gaining access to FortiGate devices through exposed endpoints. They obtain initial access using credentials from past data leaks, infostealer malware logs, credential stuffing, and password spraying techniques. Once inside, they extract additional authentication data from the compromised devices.
To escalate their access, attackers use distributed GPU clusters running Hashcat and Hashtopolis to crack stolen password hashes offline. This allows them to recover plaintext passwords and gain deeper footholds within the targeted networks.
FortiBleed Linked to Ransomware Operations
The FBI states that the FortiBleed attack chain has been observed serving as an initial entry point for ransomware affiliates. Specifically, the INC/Lynx and Payload ransomware groups have benefited from access obtained through this campaign.
The FortiBleed credential leak originated in June 2026 when researchers discovered an exposed server containing usernames and plaintext passwords tied to 73,932 FortiGate firewall URLs across 194 countries. This massive leak indicated a large-scale credential-harvesting operation, though the exact method of data collection was initially unclear.
In July 2026, SOCRadar connected the FortiBleed leak to INC and Lynx ransomware operations after accessing negotiation panels used by those groups on a server associated with the attack infrastructure. By SOCRadar's latest assessment, approximately 86,644 FortiGate devices have been compromised in the campaign.
Attackers Establish Persistence and Prepare Access for Sale
In some incidents, the FBI notes that threat actors create new administrator accounts on compromised FortiGate devices. They then use these privileges to delete existing admin accounts or change their passwords, effectively locking out the legitimate owners of the devices.
After gaining control, attackers establish persistence mechanisms and attempt to move laterally within the victim's environment. The operation's details became public after the attackers accidentally exposed their backend server, which contained a directory of tools, scripts, and datasets.
This exposed infrastructure revealed automated scripts designed to scan for exposed FortiGate SSL VPN portals, a distributed GPU-based password-cracking setup, and utilities to validate credentials, filter out honeypots, identify target organizations, and prioritize victims based on revenue and network complexity.
Additionally, the leak included working VPN configurations and target lists, suggesting that the operators were packaging and preparing compromised access for sale to other cybercriminal groups.
FBI Recommends Comprehensive Remediation Steps Beyond Patching
The FBI advises that remediation for FortiBleed compromises may require more than simply applying patches or resetting Fortinet passwords. Organizations are urged to restrict external access to management interfaces, terminate all active VPN sessions, and enforce multi-factor authentication (MFA) for administrative access.
Further recommendations include reviewing system logs for unauthorized changes or suspicious activity, and enforcing the use of PBKDF2 for administrator password storage. The FBI notes that PBKDF2 is significantly stronger than the legacy SHA-256 hashing method, which attackers can practically crack offline using GPU-powered tools.
Organizations using FortiGate devices should treat any suspected exposure as a potential breach and follow incident response procedures to fully eradicate attacker presence and prevent reinfection.
Source: BleepingComputer