The FBI and U.S. Secret Service say the FortiBleed credential campaign against internet-facing FortiGate firewalls and SSL VPN gateways is still running. In some cases attackers now delete or change the original admin accounts and lock owners out of their own devices. There is no CVE and no patch. The fix is credential hygiene, MFA and getting the management plane off the internet.
What happened
On October 6, 2026 the two agencies published joint advisory JCSA-20261006-01, FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts. The advisory describes FortiBleed as an active, global credential-compromise campaign. Citing SOCRadar, it says more than 86,644 compromised devices have been verified across 194 countries. According to the advisory, the campaign relies on reused or leaked credentials and legacy SHA-256 password storage to harvest and crack authentication data at scale.
Fortinet's PSIRT analysis, published in June and cited by the advisory, states that this is not a new Fortinet vulnerability. It attributes the activity to credentials reused from earlier incidents and brute-force attacks against devices without strong passwords or MFA.
Drawing on CloudSEK's analysis of an open directory the operators left exposed, the advisory lays out the attack chain:
- Scanning for exposed FortiGate SSL VPN portals.
- Credential stuffing and password spraying using earlier Fortinet leak dumps and infostealer logs.
- Dumping FortiOS user databases and session tokens, then cracking the hashes offline on a rented GPU cluster with Hashcat and Hashtopolis.
- Creating new administrative accounts on the firewall for persistence, then running Active Directory enumeration and password spraying inside the network.
- Selling the access. The agencies call the group an initial-access broker and say the access has gone to INC/Lynx and Payload ransomware affiliates.
The new detail in this advisory is the lockouts. The attackers add accounts that were not previously on the device, and in some cases they delete or re-password the legitimate ones. The advisory notes that recovery then takes more than standard patching and password resets. It also lists indicator IPs observed between June 18 and July 23, 2026, and 19 account names seen on victim devices, including forticloud-sync, support_fortinet, adminsslvpn and fgtsecure. The Hacker News separately reports a Go-based sniffing tool, FortigateSniffer, as part of the campaign. The advisory does not mention it.
Why it matters
For identity teams, this is an exposed-identity-store problem more than a firewall bug. The FortiGate is both a privileged administrative surface and an authentication point for remote users. Once attackers have its user database and session tokens, they hold credentials they can replay against Active Directory. Admin account names that look like vendor support or cloud sync accounts are built to survive a quick review.
The lockout tactic also changes response planning. If an attacker's first move is to remove your admin, you need a break-glass path to the device that does not depend on the accounts the attacker can see. A password reset can't fix a device you can no longer sign in to.
What to check in your environment
- Inventory every FortiGate with internet-reachable admin or SSL VPN interfaces. Following the advisory's order of preference, restrict management with trusted hosts, then a local-in policy, and ideally remove internet administration entirely.
- Terminate all active admin and VPN sessions, then reset all Fortinet VPN and administrative passwords, starting with internet-facing devices.
- Enforce phishing-resistant MFA on every remote access and administrative account, on all external gateways and admin interfaces.
- Audit local admin and VPN users against a known-good configuration. Flag any of the account names listed in the advisory's Table 2 and any account you can't tie to a ticket or owner.
- Review REST API keys on each FortiGate. The advisory recommends removing unknown keys and rotating legitimate ones.
- Confirm administrator credentials are stored with PBKDF2 rather than legacy hashes. The advisory points to Fortinet's technical tip on enforcing PBKDF2 for admin accounts in FortiOS 7.2.11 and later.
- Search firewall, VPN, authentication and domain controller logs for the advisory's IP indicators and for SSH access to the firewall. Vet the IPs before blocking them, as the agencies advise.
- Document an out-of-band recovery path for each device (console access and a sealed break-glass credential) before you need it.
References
- FBI / USSS joint advisory: FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts
- Fortinet PSIRT: Analysis of reported credential compromise of FortiGate devices
- Fortinet technical tip: Enforcing PBKDF2 for administrator accounts in FortiOS 7.2.11 and later
- The Hacker News: FBI warns FortiBleed remains active