FBI: FortiBleed Attackers Can Lock Victims Out of Their Own Firewalls
Investigators reveal that threat actors are deleting admin accounts to trap themselves inside compromised FortiGate devices while blocking legitimate users.
Key points
- The FBI and US Secret Service report that attackers are locking organizations out of their own firewalls by deleting or changing administrator account passwords.
- An investigation into a backend server revealed infrastructure used to process stolen credentials, crack password hashes, and rank targets by revenue.
- The campaign has affected more than 80,000 devices worldwide, with access being offered to ransomware affiliates including INC/Lynx and Payload.
The FBI and US Secret Service have disclosed that attackers exploiting the FortiBleed vulnerability are actively locking organizations out of their own FortiGate firewalls. According to the agencies, threat actors are deleting or changing the passwords of existing administrative accounts, ensuring they remain logged in while legitimate users lose access.
This operational shift turns a vulnerability exploitation into a persistent intrusion scenario. The FBI stated that victims may find themselves unable to apply software patches because they no longer have administrative control over the device. Investigators noted that attackers often create new accounts that were not previously present on the system before removing the original ones.
Investigation Details
The federal agencies gained access to a backend server left exposed by the attackers, providing a window into the campaign’s infrastructure. According to the FBI advisory, this server hosted systems used to process stolen credentials, crack password hashes, and identify potential targets. The operators were also found ranking organizations based on their revenue and network structure, suggesting a targeted approach to high-value victims.
Muhammad Yahya Patel, vCISO and cybersecurity advisor EMEA at Huntress, emphasized that the nature of the threat has evolved. He stated that FortiBleed is no longer just a vulnerability story but a persistence issue, noting that credentials were taken months ago. The critical question for organizations, he added, is whether those stolen credentials are still being used right now.
Impact and Affiliates
The campaign has already affected more than 80,000 devices worldwide, according to the FBI and US Secret Service. Beyond locking out administrators, attackers have enumerated Active Directory environments and used compromised credentials for lateral movement within the victim networks. The agencies reported that access obtained through this campaign has been offered to ransomware affiliates, specifically naming INC/Lynx and Payload ransomware groups.
Ben Bernstein, manager of the cybersecurity advisors team at Huntress, highlighted the severity of the lockout tactic. He explained that attackers know organizations will be forced to physically factory reset and rebuild the hardware before encryption can begin. This creates a significant operational disruption that goes beyond simple remediation of a software flaw.
What should you do?
The FBI published account names and infrastructure indicators to help organizations investigate potential compromises. The agency recommended reviewing Fortinet accounts and configurations for unauthorized changes. Security teams should also check firewall, VPN, authentication, and domain controller logs for suspicious activity. Additionally, the FBI advised looking for unknown or unexpected REST API keys, which could provide attackers with automated access to FortiGate systems.
What to do and how to stay safe: Fortinet
- Review FortiGate administrative accounts for any unauthorized additions or deletions that do not match your internal records.
- Audit firewall, VPN, and domain controller logs for suspicious login attempts or lateral movement indicators.
- Check for unknown or unexpected REST API keys that could allow automated access to your FortiGate systems.
- Monitor for any changes to existing administrator passwords that were not initiated by your security team.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How are attackers locking organizations out of their FortiGate devices?
Attackers are deleting existing administrative accounts or changing their passwords, preventing legitimate users from logging in while the attackers maintain access.
How many devices have been affected by the FortiBleed campaign?
According to the FBI and US Secret Service, the operation has affected more than 80,000 devices worldwide.
Which ransomware groups have received access from this campaign?
The FBI stated that access obtained through the campaign has been offered to ransomware affiliates including INC/Lynx and Payload ransomware.
