FortiBleed Hackers Lock Organizations Out of Fortinet Devices

The FortiBleed credential-harvesting and access-broker campaign is targeting internet-accessible Fortinet FortiGate firewalls and SSL VPN appliances. The campaign began in June, and Fortinet’s analysis found that attackers used previously compromised credentials and brute-force methods to take over poorly protected devices.

Within a week of its start, the attacks had reached more than 86,000 Fortinet devices in 190 countries. A Russian initial access broker has been linked to the campaign. SOCRadar later confirmed 86,644 compromised devices across 194 countries.

SOCRadar’s figure covers confirmed compromises, not exposed devices. The company reported that devices breached months ago remain in the attackers’ validated inventory.

In a joint advisory issued this week, the FBI and the U.S. Secret Service warned that attackers have locked organizations out of Fortinet appliances by changing passwords or deleting accounts.

“Some victims may get locked out of their Fortinet devices if the threat actor either deletes or changes the password for original accounts on the system,” the advisory states. Attackers have also deleted accounts to block administrators, maintain access and attempt to move through victims’ networks.

The campaign has involved scanning for exposed SSL VPN portals, collecting credentials from infostealer logs and previous data breaches, and cracking hashed passwords offline. The attackers have mapped victims’ networks to avoid honeypots, used verified credentials to compromise devices, and sold working VPN configurations and target lists to other threat actors.

The FBI and Secret Service urged affected organizations to identify compromised hosts, determine the scope of the intrusion, remove the attackers, strengthen defenses and report the incidents. Their recommendations include restricting management access, resetting Fortinet VPN and administrator passwords, deploying phishing-resistant multifactor authentication, reviewing firewall and VPN users and configurations, validating API keys, checking logs for suspicious activity and storing credentials securely.