Organizations running internet-facing Fortinet FortiGate firewalls and SSL VPN gateways can act now to stop a credential-harvesting campaign that the FBI and U.S. Secret Service confirm is still active. The same advisory warns that more than 86,644 working device credentials have been collected across 194 countries, giving attackers a ready supply of working logins for SSL VPN and administrative access.<\/p>\n
The campaign, tracked as FortiBleed, exploits reused and leaked credentials along with legacy SHA-256 password storage, and it lets threat actors crack authentication data at scale. A flagged risk is that some victims may lose access to their own Fortinet devices if attackers delete or change the original account passwords after creating new administrative accounts to hold persistence.<\/p>\n
The joint advisory states that attackers are continuing to scan internet-exposed Fortinet firewalls using previously obtained compromised credentials. It traces the activity to a five-stage operation that runs widespread reconnaissance, gains access through credential stuffing and password spraying against data drawn from prior leak dumps and infostealer logs, then deploys a Go-based tool called FortigateSniffer. FortigateSniffer passively intercepts authentication traffic across 24 protocols to harvest credentials and password hashes.<\/p>\n
Harvested password hashes are then routed to a GPU-accelerated cracking cluster using Hashmat and Hashtopolis for offline cracking. With verified credentials in hand, attackers move deeper into victim environments, conduct enumeration, and run additional password spraying to identify privileged accounts. New administrative accounts are created on the firewall to maintain persistence, and in some cases existing accounts are deleted, locking the real IT team out of the appliance.<\/p>\n
The advisory also notes that cracked credentials are enriched, sorted, and validated, with scripts filtering out honeypots, mapping organizations, and prioritizing high-value targets based on revenue and network structure.<\/p>\n
FortiBleed was first documented by SOCRadar and Hudson Rock in June 2026. As of June 19, 2026, the operation is estimated to have netted more than 86,644 working device credentials spanning 194 countries. The advisory describes the actors as a Russian-speaking operation believed to function as an initial access broker that packages stolen information and sells it to downstream threat actors.<\/p>\n
Operator overlaps have tied FortiBleed access to INC and Lynx ransomware operations, indicating that the access is being abused for ransomware deployment. Threat intelligence from SOCRadar has confirmed at least 12 ransomware deployments stemming from this access, resulting in hundreds of endpoints getting encrypted, and the same access has been supplied to Payload ransomware affiliates, evidence the operation is financially motivated and tied to a broader ransomware supply chain.<\/p>\n
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is urging Fortinet customers with FortiGate appliances to take these steps:<\/p>\n
If potential compromise is detected, the FBI and USSS recommend isolating the affected devices, collecting necessary artifacts and logs, reporting the incident to the FBI and USSS, and applying relevant countermeasures to mitigate the threat.<\/p>\n
The advisory lists account names frequently seen on compromised Fortinet devices. Reviewing local and API accounts against this list is a fast way to spot unauthorized additions:<\/p>\n
The core lesson in the advisory is that exposed credentials do not become harmless with age. If they remain valid, or if attackers have already created persistent accounts on the appliance, they can keep providing an entry point months after the original harvesting activity. Treating possible exposure as a compromise scenario, restricting external management, terminating active sessions, rotating administrative and VPN credentials, enforcing phishing-resistant MFA, and investigating downstream activity, is a stronger response than relying on patching alone.<\/p>\n
Targeting edge devices like VPNs and firewalls is a familiar pattern, but this campaign stands out for the gap between silent initial access and aggressive takeover. Attackers are stealing configuration files, cracking password hashes offline, and logging in without generating a single failed login alert. Once inside, they change administrator passwords, lock the IT team out of the equipment, and hand access to ransomware groups. When an organization loses access to its own firewall, a software patch is not enough, and a physical factory reset and hardware rebuild may be required before encryption begins.<\/p>\n
FortiBleed is a credential harvesting campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. It was first documented in June 2026 and is estimated to have collected more than 86,644 working device credentials across 194 countries.<\/p>\n
Enable phishing-resistant authentication, terminate active SSL VPN and administrative sessions, reset Fortinet VPN and administrative passwords, store administrator credentials using PBKDF2, and review logs for suspicious activity. Audit local and API accounts for unauthorized additions and remove internet-facing administration interfaces where possible.<\/p>\n
Operator overlaps tie FortiBleed-derived access to INC and Lynx ransomware operations, and the same access has been supplied to Payload ransomware affiliates. At least 12 ransomware deployments have been confirmed from this access, with hundreds of endpoints encrypted.<\/p>\n