FortiBleed: FBI and Secret Service say FortiGate attacks continue

On 6 October 2026 the FBI and the US Secret Service published a joint advisory on FortiBleed, the credential theft campaign against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The main message is that the campaign is still active: attackers keep scanning internet-exposed devices using credentials that were already compromised. There is no new vulnerability and no CVE: the problem is credentials, which is why, the agencies warn, updating and changing passwords may not be enough.

What happened

FortiBleed came to light in June, when the campaign’s operators accidentally exposed one of their backend servers, with tools, scripts and data. According to BleepingComputer it held usernames and plaintext passwords associated with 73,932 firewall addresses in 194 countries. The advisory cites verification by threat intelligence firm SOCRadar: more than 86,644 compromised devices in 194 countries. SOCRadar’s CISO told CyberScoop that the wider operation targeted between 400,000 and 450,000 firewalls, adding that figures gathered at different times are not fully comparable.

What the advisory adds is mainly two things:

• in some incidents the attackers locked out legitimate administrators, deleting existing accounts or changing their passwords;
• the FortiBleed attack chain has been observed as an entry point for ransomware affiliates, through initial access brokers reselling the access. The outlets name INC/Lynx and Payload (Infosecurity Magazine lists them as three groups: INC, Lynx and Payload). Back in July SOCRadar had linked the campaign to INC and Lynx and, according to The Register, counted at least 12 confirmed ransomware attacks originating from FortiBleed.

Technical details: the attack chain

From the advisory and the material found on the server, the sources reconstruct these stages:

1. Automated scanning of the internet for exposed FortiGate SSL VPN portals.
2. Credential stuffing and password spraying with credentials from earlier Fortinet leaks and infostealer logs.
3. Extraction of further authentication data from compromised devices, including password hashes, which are then cracked offline on a GPU cluster (rented, according to CSO Online) running Hashcat and Hashtopolis.
4. Target selection: scripts that validate credentials, filter out honeypots, identify the organisation and rank it by revenue and network structure. According to BleepingComputer the server also held working VPN configurations and target lists, a sign that access was being packaged for sale.
5. Persistence: creation of new administrator accounts on the firewall; in some cases, according to CSO Online, SSH was also used where the port was exposed.
6. Lateral movement: Active Directory enumeration and internal password spraying to find privileged accounts.
7. Administrator lockout: deletion of the original accounts or changes to their passwords, to hinder response and keep access.

One detail weighs on stage 3: storing administrator passwords in the legacy SHA-256 format makes large-scale cracking practical. The agencies recommend PBKDF2; Security Affairs reports that Fortinet recommends it for administrator passwords on FortiOS 7.2.11 and later.

MITRE ATT&CK: the advisory cites T1531 (Account Access Removal) for the account lockout. The other stages map to T1133 (External Remote Services), T1110.004 (Credential Stuffing), T1110.003 (Password Spraying), T1110.002 (Password Cracking), T1078 (Valid Accounts), T1136 (Create Account) and T1087.002 (Domain Account Discovery).

Published indicators

According to Security Affairs, the advisory lists 45.154.12[.]132 as a command and control server, 154.202.59[.]169 and 103.27.186[.]156 as proxy nodes and 45.155.250[.]158 as a beacon relay. Account names found on compromised devices include admin, fortiAdmin and itadmin. The agencies ask organisations to vet the indicators before blocking them: some of the infrastructure may have been dynamically or temporarily assigned.

Impact for European and Italian companies

With 194 countries involved, the campaign is not a US-only matter: any organisation with a FortiGate or an SSL VPN reachable from the internet is a potential target. The risk goes beyond the firewall: valid VPN access is a way into the internal network, and the harvested access is resold to ransomware groups. When credentials have been cracked offline, as CSO Online notes, the login succeeds on the first attempt and leaves no failed logins to spot.

For entities in scope of NIS2, a compromised firewall or VPN is an incident to assess for notification to the national CSIRT (in Italy, CSIRT Italia at ACN), which for significant incidents requires an early warning within 24 hours. The same care applies to healthcare, where ransomware can disrupt essential services.

What to do now

1. Reduce exposure: restrict internet-facing management to trusted systems only, including through a local-in policy, or better still remove it entirely.
2. End sessions and change credentials: terminate all active administrative and VPN sessions and reset administrative and VPN passwords on exposed systems.
3. Enable phishing-resistant MFA on all remote access and administrator accounts.
4. Check the configuration: look for firewall and VPN users you do not recognise, unauthorised changes and unknown or unexpected REST API keys.
5. Review the logs of firewalls, VPN, authentication and domain controllers for lateral movement, and compare them with the advisory’s indicators.
6. Switch to PBKDF2 for storing administrator passwords.
7. If you find a compromise: isolate the affected hosts, run threat hunting to scope the intrusion and plan the attacker’s eviction (the advisory points to CISA’s Eviction Strategies Tool). The agencies advise against paying ransoms.

How ARXDOME helps

ARX Expose shows what your company exposes on the internet, including open ports and recognised products, and flags company accounts involved in breaches: it helps you find a VPN portal or a management interface reachable from outside. ARX Sentry collects firewall logs and, through the agent, events from computers and servers: the SOC identity pages show privileged logins, bursts of attempts and account changes, and the NOC map shows VPN errors. With ARX Horizon you can search indicators of compromise and address reputation from the portal.

Last updated: 8 October 2026