FBI and Secret Service warn of FortiBleed campaign against Fortinet
XORit Editorial · Sources, AI assistance and corrections
The FBI and the US Secret Service have issued a joint warning about the FortiBleed campaign. It began in June 2026 and remains active: the targets are internet-facing FortiGate firewalls and Fortinet VPN gateways. A distinctive feature of the campaign is that the attackers change passwords and delete accounts, so an organization can lose access to its own equipment.
According to Fortinet's analysis, previously compromised credentials and password brute-forcing were used to seize poorly protected devices. In the first week, the attacks affected more than 86,000 Fortinet devices in 190 countries, and responsibility was then attributed to a Russian initial access broker. Now SOCRadar reports about 86,644 confirmed compromised devices in 194 countries.
SOCRadar separately notes that this is the number of confirmed compromises, not an estimate of exposure: devices compromised months earlier remain in the attackers' verified inventory. The FBI and USSS note that deleting existing accounts serves both to block access and to keep a foothold while attempting to move further through the network.
Among the techniques described in the warning: scanning exposed SSL VPN portals, collecting credentials from infostealer logs and old leaks, offline cracking of password hashes, mapping the attack surface to bypass honeypot traps, and selling working VPN configurations and target lists to other groups.
What the FBI and Secret Service advise
Organizations are advised to identify compromised hosts, assess the scale of the intrusion, evict the attackers, strengthen defenses, and report the incident. To reduce the attack surface, they should restrict management access, change all VPN and Fortinet administrator passwords, enable phishing-resistant multi-factor authentication, review users, configurations, and API keys, inspect logs for suspicious activity, and ensure credentials are stored securely.
Image: Premeditated CC BY-SA 4.0 · License
Translation editors: Соловьев В., Пеков А.
Source: www.securityweek.com ↗