FortiBleed campaign targets Fortinet firewalls and VPN gateways

The FBI and Secret Service have issued an alert regarding FortiBleed, an ongoing credential compromise campaign targeting Fortinet firewalls and VPN gateways. The campaign allows threat actors to gain access to exposed devices, where they can create new administration accounts, change passwords, or disable existing accounts to lock legitimate users out of their systems.

Security experts note that standard remediation, such as patching and password resets, may be insufficient once an account is compromised. The attack chain has also been identified as an initial entry point for ransomware affiliates, including groups such as INC/Lynx and Payload.

While initial investigations by SOCRadar identified over 86,000 compromised devices across 194 countries, Ensar Seker, chief information security officer at SOCRadar, stated that later investigations identified between 400,000 and 450,000 firewalls targeted by the wider operation.