FBI Warns of Escalating FortiBleed Credential Harvesting Campaign

Executive Summary

On October 6, 2026, the FBI and U.S. Secret Service issued a joint Cybersecurity Advisory (JCSA-20261006-01) regarding an escalating global campaign dubbed "FortiBleed." This operation targets internet-exposed Fortinet FortiGate firewalls and SSL VPN gateways. Threat actors are harvesting credentials, locking out legitimate administrators, and selling the access to ransomware affiliates. The attack does not leverage a specific CVE but relies on credential stuffing and brute-force attacks against devices with poor password hygiene and no multi-factor authentication. With over 86,000 devices reportedly compromised worldwide, organizations using Fortinet products are urged to implement phishing-resistant MFA and reset all credentials immediately to mitigate the high risk of ransomware deployment.

Threat Overview

The "FortiBleed" campaign represents a significant threat to organizations relying on Fortinet security appliances. Initial access brokers are systematically targeting these devices to harvest credentials. The campaign's tactics have evolved; attackers are now actively changing passwords or disabling legitimate administrator accounts, effectively locking organizations out of their own perimeter security devices. This prevents IT staff from responding to the intrusion and makes remediation significantly more complex than a simple password reset.

The advisory confirms that access gained through FortiBleed is being sold on dark web forums to ransomware affiliates. The INC, Lynx, and Payload ransomware groups have been observed leveraging this access for initial entry into victim networks. The campaign's reach is global, with security firm SOCRadar reporting over 86,644 compromised devices across 194 countries, affecting all 16 U.S. critical infrastructure sectors.

Technical Analysis

The attack chain does not rely on a software vulnerability. Instead, it exploits weak security configurations. The primary techniques observed are:

1. Credential Stuffing & Brute-Forcing: Attackers use leaked credentials or brute-force methods against FortiGate management interfaces and SSL VPN portals that lack multi-factor authentication. This is mapped to MITRE ATT&CK T1110 - Brute Force.
2. Credential Interception: A custom Golang-based tool, described as a "FortiGate sniffer," is used to intercept authentication traffic and exfiltrate password hashes.
3. Offline Password Cracking: The exfiltrated hashes are cracked offline using GPU-accelerated clusters, enabling attackers to recover plaintext passwords.
4. Valid Account Usage: Once credentials are confirmed, attackers log in as legitimate administrators to establish persistence, lock out other users, and prepare the environment for sale. This corresponds to T1078 - Valid Accounts.
5. Account Manipulation: Attackers disable or change passwords for legitimate accounts, a form of defense evasion and impact mapped to T1098 - Account Manipulation.

Impact Assessment

The operational impact of this campaign is severe. Being locked out of a primary firewall cripples an organization's ability to manage its network security, investigate the breach, and evict the threat actor. This provides the attacker with an uncontested foothold within the network. The subsequent sale of this access to sophisticated ransomware groups like INC means that the initial intrusion is often a precursor to a full-blown ransomware attack, leading to data encryption, exfiltration, and significant financial and operational disruption. The targeting of all 16 critical infrastructure sectors, including energy, healthcare, and government, elevates this campaign to a national security concern.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) such as IP addresses, domains, or file hashes were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns which could indicate related activity:

Detection & Response

Defenders should proactively hunt for signs of compromise.

1. Log Analysis: Continuously analyze FortiGate authentication logs for brute-force attempts (many failed logins followed by a success from the same IP), logins from anomalous geolocations, and password changes outside of normal change windows. Utilize SIEM rules to automate this detection. This aligns with D3FEND's User Geolocation Logon Pattern Analysis.
2. Session Review: Regularly audit and terminate any suspicious or long-running administrative and VPN sessions.
3. Incident Response: If a compromise is suspected, immediately isolate the affected FortiGate device from the network to prevent further lateral movement. Preserve logs, memory dumps, and disk images for forensic analysis. Reset all credentials associated with the device, including service accounts, API keys, and local user accounts.

Mitigation

Remediation focuses on hardening credential security and access controls.

• Multi-Factor Authentication (MFA): This is the most critical mitigation. Enforce phishing-resistant MFA (e.g., FIDO2) for all administrative and SSL VPN user accounts. This is a direct countermeasure to credential stuffing and brute-force attacks. This aligns with D3FEND's Multi-factor Authentication.
• Strong Password Policies: Enforce the use of long, complex, and unique passwords for all accounts. This is covered by D3FEND's Strong Password Policy.
• Restrict Access: Limit access to the FortiGate management interface to a small set of trusted IP addresses on a dedicated management network. This hardening measure aligns with D3FEND's Network Isolation.
• Regular Audits: Routinely audit administrative accounts, removing any that are dormant or no longer necessary.