Key facts
- A joint FBI and US Secret Service advisory warns that FortiBleed attackers are locking organizations out of Fortinet devices by deleting original accounts or changing their passwords.
- During the initial intrusion, attackers create new accounts that were not previously on the device. In some cases they delete existing accounts to block access and keep persistence while attempting lateral movement.
- SOCRadar's CISO told CyberScoop that later investigation found more than 400,000 or 450,000 firewalls targeted by the wider operation. He said direct comparisons with the earlier figure are imprecise.
- Validated credentials are filtered to remove honeypots and ranked by victim revenue and network structure. After entry, attackers enumerate Active Directory and look for privileged accounts.
A joint FBI and US Secret Service advisory dated Oct. 6, 2026, warns that FortiBleed attackers are locking organizations out of Fortinet devices by deleting original accounts or changing their passwords, according to SecurityWeek. The sources cite no CVE and no vendor patch for the campaign. Fortinet’s one cited recommendation is PBKDF2 password storage for admin passwords on FortiOS 7.2.11 and later, per Security Affairs.
Is someone exploiting it? Yes, according to the advisory as reported: the campaign began in June and is still active, SecurityWeek says. Is there a fix? The campaign relies on stolen and decrypted credentials, per Security Affairs, so the defense centers on accounts and access.
What the attackers do on the device
Help Net Security reports that during the initial intrusion, attackers create accounts that were not on the device. In some cases they delete existing accounts to block access and keep persistence while attempting lateral movement, meaning spreading to other systems on the network.
Help Net Security also reports that the advisory lists attacker IP addresses and usernames seen on victim devices, including admin, fortiAdmin and itadmin. The agencies say to vet those indicators before blocking them, because cloud infrastructure is reassigned.
How attackers gain access
Security Affairs reports that the operators reuse credentials from earlier Fortinet leak dumps and infostealer logs, using credential stuffing and password spraying. Infostealers are malware that harvest saved logins from infected machines.
Help Net Security says the attackers also pull password hashes and decrypt them on a GPU cluster running Hashcat and Hashtopolis. Security Affairs adds that legacy SHA-256 password storage made decryption easier.
Help Net Security reports that attackers filter validated credentials to remove honeypots and rank them by victim revenue and network structure. After entry, attackers list Active Directory and look for privileged accounts.
Scale of the campaign
The campaign targets internet-facing FortiGate firewalls and SSL VPN gateways, according to CyberScoop. SOCRadar’s verified count is more than 86,644 compromised devices in 194 countries, CyberScoop reports. SecurityWeek cites an earlier SOCRadar figure of over 86,000 devices in 190 countries.
SOCRadar told SecurityWeek its number counts devices confirmed as compromised, not exposure, and that devices breached months ago stay in the attackers’ validated inventory.
CyberScoop reports that SOCRadar CISO Ensar Seker said further investigation found more than 400,000 or 450,000 firewalls targeted by the wider operation. He said direct comparisons with the earlier figure are imprecise.
SecurityWeek says someone blamed a Russian initial access broker early on, without saying who made that attribution.
Why the lockout matters
Help Net Security reports that attackers sell access gained through FortiBleed to ransomware affiliates, including INC/Lynx and Payload. CyberScoop reports that the chain serves as an initial entry point for ransomware.
Analysis: a password reset alone leaves attacker-created accounts in place, and the sources say recovery can demand more than standard steps. A defender’s order of work, drawn from the agency guidance and Security Affairs advice below, would be: audit accounts and configurations, end active sessions, restrict management access, then reset passwords.
What the agencies recommend
SecurityWeek, CyberScoop and Security Affairs each report agency guidance covering these steps:
- Restrict or remove internet-facing management access.
- Reset all VPN and admin passwords.
- Use phishing-resistant multifactor authentication.
- Review firewall and VPN users and configurations for unauthorized changes.
- Check API keys.
- Review logs for suspicious activity and lateral movement.
- Store credentials securely.
Security Affairs separately urges ending all active admin and VPN sessions and using a local-in policy, a FortiGate rule that limits which addresses can reach the device itself, to restrict management access. Help Net Security reports the FBI and Secret Service urge victims to report intrusions, though reporting is voluntary, and warn against paying ransoms.
Join the discussion