The FBI and the U.S. Secret Service say the credential-compromise campaign known as FortiBleed is still targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, and that some victims may be locked out of their own devices. The two agencies published a joint advisory on October 6, 2026, titled FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts (reference JCSA-20261006-01). It also ties the campaign to ransomware: "the FortiBleed attack chain has been observed as an initial entry point for ransomware affiliates," the agencies write.

The advisory describes FortiBleed as "an active, global credential-compromise campaign." It cites no CVE. According to the agencies, the campaign "exploits reused or leaked credentials and legacy SHA-256 password storage, enabling threat actors to harvest and crack authentication data at scale." The FBI and Secret Service warn that affected organizations may need to take "remediation steps beyond standard patching and password resets."

How the campaign works

The agencies say the operation's internal workflow became visible only after the threat actors accidentally exposed their own backend server. The advisory's summary of that material, which draws on CloudSEK's analysis, describes an initial access broker running a multi-stage operation. The operators scanned the internet for exposed FortiGate SSL VPN portals. They gathered credentials through credential stuffing and password spraying, using earlier Fortinet leak dumps and infostealer logs. They also took password hashes from compromised devices and cracked them offline on a rented, distributed GPU cluster.

The advisory says the cracked credentials were then validated and sorted. Scripts filtered out honeypots and ranked targets by revenue and network structure. The attackers created new administrator accounts on the firewalls to keep their access, then moved into victim networks to enumerate Active Directory and look for privileged accounts. According to the agencies, the operation "culminated in packaging and selling access" to other threat actors.

The lockouts in the advisory's title come from what happens after access is gained. The agencies say attackers create accounts that did not exist on the device before. In some cases they delete the original accounts or change their passwords, which blocks the organization from its own device while the attacker keeps a foothold and tries to move laterally. The advisory also says attackers may have used SSH where that port was open on the firewall.

On ransomware, the advisory says that "reporting indicates" initial access brokers using the FortiBleed attack chain have passed access to ransomware affiliates, "currently including INC/Lynx ransomware and Payload ransomware." BleepingComputer reports that SOCRadar linked FortiBleed to INC and Lynx operations in July.

How many devices are affected

The estimates depend on the source and on when the count was taken.

  • June 2026 server exposure. BleepingComputer reports that the exposed attacker server revealed usernames and plaintext passwords tied to 73,932 firewall URLs in 194 countries.
  • CISA, June 18. CISA's alert said the leaked credentials were associated with approximately 74,000 Fortinet devices, including firewalls and VPN gateways.
  • SOCRadar, as cited by the FBI and Secret Service. The advisory says SOCRadar has verified "more than 86,644 compromised devices across 194 countries."

The Record cites a July SOCRadar study that found more than 20 affiliates in defined roles scanning thousands of FortiGate portals in more than 150 countries. According to that study, at least 12 organizations were breached and had data encrypted with ransomware.

A sequence of warnings

CISA published its alert on June 18, 2026, and revised it on June 22 to add a link to Fortinet's guidance. It urged customers to end active sessions, reset credentials, and keep firewall administration off the public internet. The Record reports that UK officials issued warnings at the same time. The FBI and Secret Service advisory followed on October 6. The advisory's own IP address tables list scanning and login activity observed between June 18 and July 23, 2026.

What It Means for Defenders

The FBI and Secret Service recommend the following steps:

  • Lock down management access. Restrict external management through trusted hosts ("good"), a local-in policy ("better"), or remove internet administration altogether ("best").
  • Terminate sessions and reset credentials. End all active administrative and VPN sessions, reset every Fortinet VPN and administrator password, especially on internet-facing systems, and enforce strong password policies.
  • Require phishing-resistant MFA on all remote-access and administrative accounts, and enforce it on every external gateway and administrative interface.
  • Validate configuration and accounts. Compare firewall and VPN users and settings against a known-good configuration, and look for accounts you don't recognize. The advisory lists account names commonly found on compromised devices, including forticloud-sync, support_fortinet and adminsslvpn. Review all REST API keys, remove any unknown ones, and refresh the legitimate ones.
  • Move to PBKDF2. Confirm administrator credentials are stored with PBKDF2 and remove weaker legacy hashes, following Fortinet's guidance for FortiOS 7.2.11 and later.
  • Review logs. Check firewall, VPN, authentication and domain controller logs for lateral movement, unusual access, suspicious accounts and unauthorized configuration changes. The advisory lists attacker IP addresses with the dates they were seen, among them a command-and-control server at 45.154.12[.]132. The agencies caution that these addresses may since have been reassigned to benign services and should be checked against current telemetry before you block them.

If you find a compromise, the advisory says to isolate the affected hosts, scope the intrusion through threat hunting, report it to the FBI or Secret Service, and then carry out eviction countermeasures, such as those in CISA's Eviction Strategies Tool.

Sources