FBI confirms 86,644 Fortinet devices compromised via FortiBleed

The FBI and US Secret Service have issued a warning about a persistent cyberattack campaign targeting Fortinet firewalls and SSL VPN gateways. The agencies confirmed that criminals are using credentials from previous breaches to gain unauthorized access to devices, often locking organizations out of their own systems by altering or deleting account passwords. The advisory, published earlier this week, highlights the scale of the threat, with security firm SOCRadar verifying over 86,644 compromised devices across 194 countries.

The attackers exploit internet-facing FortiGate firewalls and VPN gateways using credential stuffing and password spraying techniques. Once inside, they create new accounts to maintain persistence, extract password hashes, and crack them offline using GPU-accelerated clusters. In some cases, existing accounts are deleted to prevent organizations from regaining control, while the attackers attempt lateral movement within the network. The advisory links the campaign to ransomware groups, specifically identifying affiliates of INC/Lynx and Payload as active participants. SOCRadar previously reported at least 12 confirmed ransomware attacks stemming from these compromises.

How the attacks unfold

The campaign leverages credentials obtained from earlier data breaches and infostealer logs, which are then used to infiltrate Fortinet devices. Attackers prioritize maintaining access by creating unauthorized accounts and, in some instances, deleting legitimate ones. The extraction of password hashes allows them to crack credentials offline, reducing the risk of detection during the process. The FBI and Secret Service noted that initial access brokers have supplied compromised network access to ransomware affiliates, amplifying the impact of the breaches.

Organizations are advised to restrict internet-facing management access, terminate active administrative and VPN sessions, and reset all passwords. The agencies also emphasized the importance of enabling phishing-resistant multi-factor authentication (MFA) to mitigate the risk of credential-based attacks. While victim reporting is encouraged to help identify indicators of compromise, the advisory clarifies that organizations are not obligated to respond.

Ransomware and broader implications

The advisory underscores the connection between the FortiBleed campaign and ransomware operations. SOCRadar’s findings indicate that compromised credentials have been actively used by ransomware affiliates, with at least 12 confirmed attacks linked to the campaign. The FBI and Secret Service warned against paying ransoms, noting that such payments do not guarantee the recovery of data or prevent future attacks. Instead, they urged organizations to focus on securing their systems and reporting incidents to aid in broader threat intelligence efforts.

What to watch

The ongoing nature of the campaign suggests that attackers will continue to exploit weak or reused credentials. Security teams should monitor for unusual account activity, particularly the creation of new accounts or the deletion of existing ones. The advisory’s call for victim reporting also indicates that further details about the campaign’s scope and tactics may emerge as more organizations come forward.