8 OCT 2026 — The FortiBleed campaign against Fortinet firewalls has not stopped, and some of its victims are now being locked out of their own devices. In a joint advisory published on 6 October, the FBI and the US Secret Service say attackers are deleting or changing the passwords of legitimate administrator accounts after creating their own, and that access gained this way is being sold to ransomware affiliates.
FortiBleed is not a software flaw. As we reported in July, it is a credential campaign against internet-facing FortiGate firewalls and their SSL VPN gateways, built on reused passwords and weak account hygiene, so no single patch closes it.
Two counts, both large
The advisory, numbered JCSA-20261006-01, cites the threat intelligence firm SOCRadar as verifying more than 86,644 compromised devices across 194 countries. That figure comes from SOCRadar's investigation, first published in June. The dataset we reported on in July, from Recorded Future, covered 73,932 FortiGate addresses. Those are two firms' counts, not a measure of growth.
The agencies' new finding is that the campaign is still running. Initial findings, the advisory says, indicate that attackers "are continuing to scan internet-exposed Fortinet firewalls using previously obtained compromised credentials".
How the operation works
Behind it is a credential-harvesting and access-broker operation, and the advisory says its workings became visible only after the operators accidentally exposed their own backend server. They scanned for FortiGate VPN portals, tried passwords from earlier Fortinet leaks and infostealer logs, and pulled password hashes from devices they reached.
Those hashes went to a cluster of rented graphics processors running the cracking tools Hashcat and Hashtopolis. The operators checked cracked logins, filtered out honeypots, and ranked victims by revenue and network structure. Once inside, they enumerated Active Directory, sprayed passwords to widen access, and packaged working VPN configurations for sale.
Why admins are being locked out
After getting in, the attackers create new administrator accounts. "In certain cases," the advisory says, they then "delete existing accounts to block organizations from accessing affected devices and to maintain persistence on the system while attempting lateral movement".
That turns a credential problem into an outage. A victim who cannot log in to its own firewall cannot simply reset passwords, and the agencies warn that remediation may need steps "beyond standard patching and password resets".
The advisory lists account names attackers have created, including forticloud-sync, support_fortinet, adminsslvpn and fortiAdmin. The names are chosen to look like legitimate system or vendor accounts. It also publishes IP addresses seen in victim logs between June and July.
The password storage problem
A fast hash such as SHA-256 is practical to crack offline with enough graphics processors, so devices that still store administrator passwords that way are exposed. The agencies tell organisations to confirm they use PBKDF2, a deliberately slow algorithm, and to remove the weaker legacy hashes, following Fortinet's guidance for FortiOS 7.2.11 and later.
What to do now
The advisory's priorities are to take device management off the internet entirely if possible, or restrict it to trusted hosts; end all administrator and VPN sessions and reset every Fortinet VPN and administrator password; and require phishing-resistant multifactor authentication on all remote access and admin accounts.
It also asks organisations to compare configurations against a known-good copy, look for unfamiliar accounts, review firewall, VPN and domain controller logs, and remove any REST API keys they cannot account for. If a compromise is found, the order is to isolate, investigate and only then evict, once enough has been gathered to choose the right countermeasures.
View author profile → · Editorial policy
