FortiBleed Fortinet credential compromise campaign

The FBI and U.S. Secret Service have issued advisories regarding ‘FortiBleed’, a credential compromise campaign targeting Fortinet FortiGate firewalls and SSL VPN gateways. The operation exploits leaked credentials and legacy SHA-256 password storage through methods such as automated scanning, credential stuffing, and password spraying.

Once access is gained, threat actors can create new administrative accounts, change passwords, or disable existing accounts to lock legitimate users out of their systems. This activity has been identified as an initial entry point for ransomware affiliates, including groups such as INC/Lynx and Payload.

Initial reports from SOCRadar identified over 86,000 compromised devices across 194 countries, though later investigations suggested the wider operation may have targeted between 400,000 and 450,000 firewalls. The threat affects all 16 critical infrastructure sectors, including energy, healthcare, communications, and transportation. Recommended mitigations include restricting external management access, terminating active sessions, resetting credentials, and enforcing phishing-resistant multi-factor authentication.