How FortiBleed attackers steal credentials from Fortinet firewalls
US agencies warn that credential theft campaigns target critical infrastructure via exposed FortiGate devices, risking total system lockout for victims.
Key points
- FBI and Secret Service warn of ongoing FortiBleed attacks on critical infrastructure sectors.
- Over 86,000 compromised devices identified across 194 countries by SOCRadar.
- Attackers use GPU clusters to crack stolen password hashes and sell access.
The short version
- US law enforcement agencies urge operators to secure Fortinet gateways against credential theft.
- The campaign targets internet-facing FortiGate firewalls and SSL VPN gateways.
- Victims risk being locked out of systems as attackers create new admin accounts.
The details
The Federal Bureau of Investigation and the U.S. Secret Service issued a joint warning regarding the FortiBleed campaign. This operation targets internet-facing Fortinet FortiGate firewalls and secure socket layer virtual private network gateways, according to Industrial Cyber. The agencies stated that the campaign continues to exploit reused or leaked credentials alongside legacy SHA-256 password storage methods. Attackers harvest authentication data at scale, potentially locking organisations out of affected systems entirely.
SOCRadar verified more than 86,644 compromised devices across 194 countries, as reported in the advisory. The threat actors use automated scanning, credential stuffing, and password spraying to locate vulnerable systems. They then harvest authentication data and crack stolen password hashes using a distributed graphics processing unit cluster. This method allows them to validate credentials efficiently before moving deeper into victim networks.
The context
The advisory applies to all 16 critical infrastructure sectors, including energy, water, healthcare, communications, and transportation systems. Attackers create new administrative accounts once credentials are validated, exploring victim networks to package compromised access for sale to other threat actors. The FBI and USSS noted that this attack chain has served as an initial entry point for ransomware affiliates, including INC/Lynx and Payload ransomware groups.
FortiBleed operates as a credential-harvesting and access-broker operation. Its internal workflow became visible only after threat actors unintentionally exposed their backend server. An open directory revealed a mature, multi-stage campaign targeting FortiGate SSL VPN appliances. The recovered tooling provides a rare end-to-end view of how operators identified targets, validated stolen credentials, and expanded access inside victim networks.
Next steps
Agencies recommend restricting external management access to FortiGate devices. Operators should terminate active administrative and VPN sessions immediately. Resetting credentials and enforcing phishing-resistant multifactor authentication are also advised. Attackers may delete existing accounts or change passwords to prevent organisations from accessing affected devices, making these steps critical for maintaining control.
Background: Threat actors
Threat actors are individuals or groups who initiate cyber attacks. They range from lone hackers to state-sponsored organisations. Understanding their motives helps you predict behaviour. You must monitor for anomalies, not just known signatures, to detect their presence before data exfiltration occurs.
Read the full guide: What Is Threat Actors: Definitions, Tactics and Detection Strategies
What to do and how to stay safe: Fortinet
- Restrict external management access to firewall appliances to limit exposure.
- Terminate active administrative and VPN sessions to revoke potential attacker access.
- Reset all credentials for FortiGate devices and enforce phishing-resistant multifactor authentication.
- Monitor for new administrative accounts that may have been created by threat actors.
Step-by-step guide: Password Manager Security Checklist: Hardening Your Vault
General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which sectors are most at risk from FortiBleed?
The advisory applies to all 16 critical infrastructure sectors, including energy, water, healthcare, communications, and transportation systems.
How do attackers crack the stolen passwords?
Attackers harvest authentication data and crack stolen password hashes on a distributed graphics processing unit cluster.
Is a patch available for this vulnerability?
The source material does not confirm that a specific patch or fix exists for the FortiBleed campaign vulnerabilities.
