FBI and Secret Service warn of ongoing FortiBleed attacks targeting critical infrastructure

The Federal Bureau of Investigation and the U.S. Secret Service issued a joint advisory warning that the FortiBleed credential-compromise campaign remains active against internet-facing Fortinet FortiGate firewalls and secure socket layer virtual private network gateways. The agencies stated that this ongoing threat can lock organizations out of their systems by allowing attackers to delete accounts or change passwords, thereby preventing legitimate access to affected devices.

According to Industrial Cyber, the advisory highlights that threat actors are exploiting reused or leaked credentials alongside legacy SHA-256 password storage methods to harvest authentication data at scale. SOCRadar verified more than 86,644 compromised devices across 194 countries, providing concrete evidence of the campaign’s reach. The agencies noted that attackers continue scanning exposed Fortinet firewalls using previously obtained credentials to maintain persistent access and expand their foothold within victim networks.

Campaign Mechanics and Exposure

The FortiBleed operation functions as a credential-harvesting and access-broker scheme, with its internal workflow becoming visible only after threat actors unintentionally exposed their backend server. An open directory on the server revealed a mature, multi-stage campaign that specifically targeted FortiGate SSL VPN appliances. The recovered tooling and datasets offer a rare, end-to-end view of how operators identified targets, validated stolen credentials, and expanded their access inside victim networks using distributed graphics processing unit clusters to crack password hashes.

Attackers initiated the campaign by scanning the internet for exposed FortiGate SSL VPN portals, using automated scripts to identify reachable devices and harvestable authentication surfaces. They employed automated scanning, credential stuffing, and password spraying techniques to find vulnerable systems. Once credentials were validated through cracking on GPU clusters, the operators created new administrative accounts to explore victim networks. These compromised access credentials were then packaged and sold to other threat actors, facilitating further malicious activities.

Sector Impact and Ransomware Links

The advisory applies to all 16 critical infrastructure sectors, explicitly naming energy, water and wastewater systems, healthcare and public health, communications, and transportation systems. The FBI and USSS emphasized that the attack chain has served as an initial entry point for ransomware affiliates, including groups associated with INC/Lynx and Payload ransomware. This connection underscores the broader risk of credential theft extending beyond initial access to significant financial and operational disruption for affected organizations.

The agencies warned that the persistence of these campaigns suggests a continuous effort by threat actors to monetize compromised access. By selling validated credentials, the FortiBleed operators enable other malicious groups to bypass traditional perimeter defenses. This model increases the likelihood of secondary attacks, such as ransomware deployment, which can severely impact the availability and integrity of critical services across multiple sectors.

What should you do?

The FBI and USSS recommended that organizations restrict external management access to Fortinet devices to reduce the attack surface. Operators should terminate active administrative and virtual private network sessions immediately to disrupt any ongoing unauthorized access. Resetting all credentials is essential to invalidate any stolen or guessed passwords, while enforcing phishing-resistant multifactor authentication adds a critical layer of protection against credential reuse and spraying attacks.

What to do and how to stay safe: Fortinet

• Restrict external management access to Fortinet FortiGate firewalls and SSL VPN gateways to limit exposure to internet-based scanning and credential attacks.
• Terminate all active administrative and VPN sessions on affected devices to immediately disrupt any ongoing unauthorized access by threat actors.
• Reset all user credentials, including administrative passwords, to invalidate any stolen or guessed authentication data and prevent further compromise.
• Enforce phishing-resistant multifactor authentication for all administrative accounts to add a critical layer of protection against credential reuse and spraying.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Fortinet products are targeted by the FortiBleed campaign?

The campaign targets Fortinet FortiGate firewalls and secure socket layer virtual private network gateways, particularly those exposed to the internet.

How many devices have been compromised according to verified data?

SOCRadar verified more than 86,644 compromised devices across 194 countries, indicating the widespread scale of the credential-harvesting operation.

What ransomware groups are linked to this attack chain?

The FBI and USSS stated that the attack chain has served as an initial entry point for ransomware affiliates, including INC/Lynx and Payload ransomware.