The FBI and the U.S. Secret Service warned Tuesday that the FortiBleed campaign against Fortinet firewalls is still active and that some victims are being locked out of their own devices, CyberScoop reported. The agencies' joint advisory, JCSA-20261006-01, also says access gained through FortiBleed is being passed to ransomware affiliates.

What Happened

FortiBleed is a global credential-compromise campaign aimed at internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The advisory cites security firm SOCRadar, which verified more than 86,644 compromised devices in 194 countries. CyberScoop reported that later research put the broader set of targeted firewalls at 400,000 to 450,000.

According to the advisory, the attackers rely on reused or leaked credentials and on legacy SHA-256 password storage. They scan for exposed VPN portals, use credential stuffing and password spraying built on earlier Fortinet leak dumps and infostealer logs, and pull password hashes from compromised devices. Those hashes are cracked offline on a rented GPU cluster, with the Hashcat and Hashtopolis tools coordinating the work.

RelatedAttackers Breach Three Country-Code Registries to Obtain Google Certificates

Once inside, the operators create new administrator accounts to keep access. In some cases they delete or change the passwords on the original accounts, which can leave organizations unable to log in to their own firewalls. The agencies say that means recovery may require steps beyond standard patching and password resets.

Why It Matters

Firewalls and VPN gateways sit at the edge of a network, so control of one can open the way to everything behind it. The advisory describes attackers enumerating Active Directory and spraying passwords inside victim networks after getting in, then packaging working VPN access and selling it. The agencies say initial access brokers using FortiBleed have supplied access to affiliates of the INC/Lynx and Payload ransomware operations.

A lockout raises the stakes. An organization that discovers an intrusion but cannot log in to its own firewall loses the ability to cut off the attacker quickly.

SOCRadar CISO Ensar Seker told CyberScoop that the newer findings "show the campaign is broader and more serious than we understood at the beginning."

How It Came to Light

The operation's inner workings became visible only after its operators accidentally exposed their own backend server, the advisory says. The open directory laid out the full pipeline, from scanning and credential validation to filtering out honeypots and ranking targets by revenue. CyberScoop reported that FortiBleed was first uncovered this summer.

What to Watch

The agencies urge Fortinet customers to restrict or remove internet-facing management, terminate all admin and VPN sessions, reset all VPN and administrative passwords, and require phishing-resistant multifactor authentication. They also recommend checking for unrecognized accounts against a list of names seen on victim devices, reviewing logs against published attacker IP addresses, auditing REST API keys and confirming that admin credentials are stored with PBKDF2 rather than older hashes. The FBI and Secret Service are asking victims to share indicators such as attacker IP addresses and usernames, and further lockout reports or ransomware cases traced to FortiBleed access are likely as organizations audit their devices.