FBI and Secret Service Warn FortiBleed Attacks Are Locking Organisations Out of Fortinet Devices

The FBI and U.S. Secret Service have warned that attackers behind the FortiBleed campaign continue to target internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, using compromised credentials to gain access, create unauthorised accounts and, in some cases, lock legitimate administrators out of their own systems.

In a joint cybersecurity advisory dated October 6, 2026, the agencies describe a global operation that combines previously leaked passwords, automated login attacks and offline password cracking. The advisory cites SOCRadar research reporting more than 86,644 compromised devices across 194 countries , while warning that access obtained through the campaign has reached ransomware affiliates.

The latest warning shifts attention from the initial theft of credentials to what happens after attackers gain control. Changing a password or installing updated firmware may leave additional accounts, API keys or access to internal systems unaddressed. For affected organisations, the response therefore extends beyond routine vulnerability management into incident investigation and recovery.

A Continuing Campaign With Consequences Beyond Stolen Passwords

The advisory, FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts , says attackers are continuing to scan exposed Fortinet firewalls using credentials obtained previously. Its guidance is directed at organisations across all 16 U.S. critical infrastructure sectors, including healthcare, energy, financial services, communications and government facilities.

Investigators have observed attackers establishing new accounts on compromised appliances and then interfering with existing accounts. In some cases, the original accounts are deleted; in others, their passwords are changed. Either action can prevent administrators from accessing the device while the intruder retains control and attempts to move further into the network.

That creates an operational problem as well as a security incident. A firewall or VPN gateway may be central to remote access and network administration. Losing trusted administrative access can complicate containment precisely when defenders need to examine settings, remove unauthorised users and restrict connectivity.

The agencies do not provide a count of organisations that have suffered lockouts, nor do they say that every device included in the reported global total remains under attacker control. The warning establishes that the activity is continuing and that previously compromised credentials remain useful to attackers.

FortiBleed Is a Credential Campaign, Not a Newly Announced Zero-Day

Despite its name, FortiBleed does not identify a single newly disclosed software flaw. The advisory describes an attack chain built around stolen or reused credentials, exposed services and weaknesses in the protection of stored passwords.

In its analysis of the reported credential compromise , Fortinet said its initial findings pointed to the reuse of credentials from incidents and brute-force activity against systems with weak password practices and no multifactor authentication. The company stated that the activity did not represent a new Fortinet vulnerability.

The distinction matters for remediation. Closing a software vulnerability does not automatically invalidate a password stolen earlier. Nor does an update necessarily remove an account that an attacker created after obtaining administrative privileges.

Credential stuffing and password spraying are both part of the activity described by the agencies. Credential stuffing tests username-and-password pairs obtained from earlier leaks, while password spraying tries a small selection of passwords across multiple accounts. Both can succeed without a fresh software exploit when exposed authentication services accept credentials already available to criminals.

An Exposed Attacker Server Revealed the Operation

Investigators obtained unusual visibility into FortiBleed because the operators left their own backend server exposed. According to the advisory, the resulting open directory revealed tools and datasets spanning target discovery, credential collection, password cracking and the preparation of access for sale.

The recovered material showed a multistage operation. Automated scanners identified reachable FortiGate SSL VPN portals. Credentials drawn from Fortinet-related leaks and infostealer logs were tested against potential victims. Password hashes obtained from compromised systems were then sent to distributed cracking infrastructure using Hashcat and Hashtopolis.

Hashcat performs password-recovery computations, while Hashtopolis coordinates cracking work across multiple computing resources. In this campaign, the agencies say graphics processing units were used to accelerate the conversion of stolen hashes into usable passwords.

The workflow continued after a password was recovered. Scripts validated access, filtered suspected honeypots, associated targets with organisations and prioritised potential victims using revenue and network information. Working VPN configurations and target lists pointed to an operation designed to supply access to other criminals.

This sequencing helps explain the persistence of the threat. Credential theft, password recovery and subsequent intrusion need not happen at the same time. Material stolen during one incident may become useful later if passwords remain unchanged or are reused elsewhere.

Why the Reported Victim Numbers Need Context

The advisory attributes its headline figure to SOCRadar’s FortiBleed investigation , which describes a verified database of more than 86,644 working device credentials across 194 countries. That figure is significant, but it should not be presented as 86,644 separately verified corporate network breaches or ransomware incidents.

CloudSEK’s examination of the exposed directory raises specific concerns translating attacker datasets into victim claims. It found that brand associations could rely on registration emails, certificates or other records linked to contractors, resellers or subsidiaries rather than the parent organisation. It also identified credentials for non-Fortinet equipment in the broader raw dataset.

CloudSEK further distinguished device-level credential records from evidence that attackers had reached internal Active Directory environments. Those represent different stages of compromise and should not be treated as interchangeable measurements.

The research supports a clear reporting distinction: the advisory describes a large and active campaign, but an organisation’s appearance in an attacker catalogue does not, by itself, establish the depth of an intrusion. Determining that requires evidence from the organisation’s own systems.

The Password-Storage Detail That Can Survive an Upgrade

One of the campaign’s technical concerns is the continued presence of older administrator password hashes. The agencies recommend that organisations verify the use of Password-Based Key Derivation Function 2, or PBKDF2, and remove weaker legacy hashes in accordance with Fortinet’s guidance.

Fortinet’s technical guidance on enforcing PBKDF2 says the improved storage scheme was introduced in FortiOS 7.2.11, 7.4.8 and 7.6.1. However, after an upgrade from an earlier release, an existing administrator’s password remains in SHA-256 form until that administrator successfully logs in or the password is updated.

There is a second complication: older hashes can remain in a hidden compatibility setting even after conversion to PBKDF2. Fortinet documents how to remove them, but the relevant setting depends on the firmware version. Removing compatibility hashes also affects access if the appliance is subsequently moved to firmware that does not support the stronger format.

These version numbers identify the introduction of the feature, rather than a recommendation to deploy those specific historical releases. The practical requirement is to check both the running software and the actual state of administrator credential storage.

Stronger storage also cannot retract a password already recovered by an attacker. That is why the advisory pairs its hashing guidance with credential resets, session termination and investigation of unauthorised access.

Ransomware Affiliates Can Inherit the Foothold

The FBI and Secret Service say initial-access brokers using the FortiBleed attack chain have provided access to ransomware affiliates, including INC/Lynx and Payload ransomware.

The advisory does not establish that all compromised devices led to ransomware deployment. Instead, it describes the connection between a credential-harvesting operation and criminals positioned to use the resulting footholds for further attacks.

After obtaining access, the attackers have been observed enumerating Active Directory accounts and using password spraying to identify additional credentials and privileges. Newly created firewall accounts provide persistence while that work continues.

For defenders, this means the original gateway is the starting point for an investigation. The agencies recommend reviewing domain controller and authentication logs alongside firewall and VPN records to establish whether activity extended into the internal network.

Fortinet separately advises that, where a compromised device has AD or LDAP integration configured, organisations should treat the integration account as compromised and monitor for its use elsewhere, additional account creation and lateral movement.

What Investigators Should Look For

The advisory includes network indicators and account names observed during investigations. Its table of scanning and authentication activity covers dates between June 18 and July 23, 2026, providing historical windows that defenders can use when searching retained logs.

Examples of account names listed include adminin, forticloud-tech, forticloud-sync, support_fortinet, system_config and adminsslvpn. These should be used as investigative leads, with account ownership, creation history and privileges checked against authorised records. A familiar-looking support name does not establish legitimacy, while a name match alone does not prove malicious activity.

The agencies also caution against treating every listed IP address as permanently hostile. Cloud and virtualised infrastructure can be reassigned, so historical indicators should be correlated with the relevant time period, current telemetry and other evidence before action is taken.

Configuration review is particularly important. Comparing an affected appliance with a known-good configuration can reveal added users and other unauthorised changes. Investigators should also look for unusual administrative access, unexpected VPN activity and evidence of movement between systems.

API access needs its own review. The advisory notes that REST API keys can support automated configuration, backups and monitoring. It recommends removing unknown keys and refreshing legitimate ones, addressing a form of access that a conventional user-password reset may leave untouched.

Recovery Requires More Than a Password Reset

For suspected compromises, the agencies recommend identifying and isolating affected hosts, collecting relevant evidence and conducting threat hunting to establish the scope and timeline of the intrusion. They call for an organised eviction plan informed by the attacker behaviour found during the investigation.

Their immediate mitigations include terminating administrative and VPN sessions, resetting associated passwords and requiring phishing-resistant multifactor authentication for remote access and administration. They also recommend reducing management exposure through trusted hosts or local-in policies, with the removal of internet-accessible administration presented as the strongest option.

Those controls address different parts of the attack chain. Restricting management access reduces opportunities to reach sensitive interfaces. Credential changes invalidate known passwords. Session termination interrupts existing authenticated access. Account, configuration and API-key reviews help identify routes the attacker may have created after entry.

The advisory’s sequence also recognises the need to preserve enough investigative evidence to choose effective countermeasures. Containment and threat hunting may overlap, but restoring access to the appliance should not be mistaken for demonstrating that the wider environment is clear.

A Perimeter-Security Warning for Business Leaders

For executives, FortiBleed illustrates how compromised authentication at the network edge can become a business-continuity issue. The device intended to enforce access controls can become an attacker’s foothold, while legitimate administrators face disruption to their own access.

The management question is therefore broader than whether a firewall has received its latest update. Organisations need evidence that administrative exposure is controlled, credentials and API access have been reviewed, unauthorised changes have been removed and any movement into internal systems has been investigated.

The FBI and Secret Service urge affected organisations to report incidents and relevant indicators through the FBI’s Internet Crime Complaint Center or their local FBI or Secret Service field offices. The agencies also discourage ransom payments, noting that payment does not guarantee recovery.

The October advisory makes clear that FortiBleed remains an active problem months after its public disclosure. For organisations with exposed Fortinet gateways, the priority is to establish whether attackers already have access and, where compromise is found, remove the full set of footholds they may have left behind.