FBI Warns FortiBleed Campaign Targets Over 86,000 Fortinet FortiGate Devices Globally

The FBI warns that the FortiBleed attack campaign remains active, with SOCRadar reporting more than 86,644 compromised Fortinet FortiGate devices across 194 countries.

Threat Times Intrusion DeskOctober 11, 20261 min read

Share LinkedIn Reddit

Illustration: A generic grey network firewall sits on a dark desk, its front panel showing three small blank status lights. — AI-generated illustration: Threat Times

Key points

The FBI issued a warning stating the FortiBleed campaign is still active and targeting Fortinet FortiGate devices.
SOCRadar reported that more than 86,644 devices have been compromised as part of this widespread campaign.
The compromised infrastructure spans 194 countries, indicating a significant global reach for these attacks.

The Federal Bureau of Investigation has issued a warning that the FortiBleed attack campaign continues to be active. This persistent threat targets Fortinet FortiGate devices, with the FBI highlighting the ongoing risk to organizations relying on this network security hardware.

SOCRadar data indicates that more than 86,644 FortiGate devices have been compromised. This large-scale impact is distributed across 194 countries, demonstrating the extensive global footprint of the FortiBleed campaign. The FBI’s alert underscores the continued relevance of this specific threat vector.

Scope of the Campaign

The scale of the compromise is significant, with tens of thousands of devices affected worldwide. According to Hackread, SOCRadar provided the specific count of 86,644 compromised units. This data point is central to the FBI’s current warning about the active nature of the campaign.

The geographic distribution covers 194 countries, suggesting that no region is immune to these attacks. The widespread nature of the compromise implies that threat actors are systematically scanning for vulnerable Fortinet installations on a global basis.

Affected Infrastructure

The primary target of this campaign is the Fortinet FortiGate product line. These devices are widely used for network security and firewall protection, making them attractive targets for attackers seeking to bypass perimeter defenses. The FBI specifically named FortiGate in its warning.

The term FortiBleed refers to the specific campaign targeting these devices. While the source material does not detail the technical mechanics, the high number of compromised devices suggests a successful exploitation strategy by the threat actors involved in this campaign.

What should you do?

Organizations should verify if their FortiGate devices are part of the compromised pool identified by SOCRadar. Network administrators need to monitor for unusual traffic patterns that may indicate active exploitation of the FortiBleed vulnerability.

Security teams should review their asset inventory to ensure all Fortinet devices are accounted for and monitored. The FBI’s warning serves as a prompt to assess current exposure to this specific campaign and its associated risks.

What to do and how to stay safe: FortiBleed

Review network logs for any signs of unauthorized access or unusual traffic patterns originating from FortiGate devices.
Verify whether any of your organization's FortiGate appliances appear in lists of compromised devices published by security researchers.
Ensure that network segmentation is properly configured to limit potential lateral movement if a device is compromised.
Monitor official channels from the FBI and Fortinet for further updates on the FortiBleed campaign and any emerging mitigations.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.