FBI and Secret Service warn of FortiBleed attacks on Fortinet devices

The FBI and the U.S. Secret Service have issued a joint advisory regarding the FortiBleed campaign, which targets internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The operation exploits reused or leaked credentials and legacy SHA-256 password storage to harvest and crack authentication data at scale.

According to SOCRadar, more than 86,644 compromised devices have been verified across 194 countries. Attackers use automated scanning, credential stuffing, and password spraying to find vulnerable systems. Once credentials are validated, they may create new administrative accounts, explore networks, and package access for sale to other threat actors. In some instances, attackers have deleted existing accounts or changed passwords, effectively locking legitimate administrators out of their own security equipment.

The advisory applies to all 16 critical infrastructure sectors, including energy, healthcare, communications, and transportation. The attack chain has been identified as an initial entry point for ransomware affiliates, such as INC/Lynx and Payload. Recommended mitigation includes restricting external management access, terminating active administrative and VPN sessions, resetting credentials, and enforcing phishing-resistant multi-factor authentication.