FBI: FortiBleed Harvested 86,644 Fortinet Device Credentials and Is Still Active

The FBI and the U.S. Secret Service issued a joint warning on Tuesday: the credential-harvesting campaign known as FortiBleed is still active and aimed at internet-facing Fortinet FortiGate firewalls and SSL VPN gateways.

According to the agencies, the operators abuse reused or leaked credentials together with Fortinet's legacy SHA-256 password storage, letting them harvest and crack authentication data at scale. Initial findings suggest attackers keep scanning exposed Fortinet firewalls using credentials obtained earlier.

FortiBleed was first documented by SOCRadar and Hudson Rock in June 2026. The Russian-speaking operation is estimated to have netted more than 86,644 working device credentials across 194 countries as of June 19, 2026. The disclosure prompted CISA to urge Fortinet customers to enable phishing-resistant authentication, terminate active SSL VPN and administrative sessions, reset passwords, switch to the PBKDF2 algorithm for storing administrator credentials, and review their logs.

A five-stage attack

The campaign unfolds in five stages. It begins with broad reconnaissance of exposed portals, then gains access through credential stuffing and password spraying drawn from prior leak dumps and infostealer logs. Next it deploys a Go-based tool called FortigateSniffer, which passively intercepts authentication traffic across 24 protocols and collects credentials and password hashes.

The hashes are routed to a GPU-accelerated cracking cluster (using Hashmat and Hashtopolis) for offline cracking, then used for lateral movement, Active Directory enumeration, Kerberos validation, and SMB authentication. In the final stage, data is exfiltrated from network shares while stolen session cookies maintain persistent, authenticated access. New administrative accounts are created on the firewall to keep a foothold.

The adversary is believed to be an initial access broker that packages and resells what it steals: operator overlaps tie FortiBleed to the INC and Lynx ransomware groups. The FBI cautions that some victims may be locked out of their own devices — attackers sometimes delete or change the passwords of original accounts to block owners and preserve control.

If a compromise is suspected, organizations are advised to isolate affected devices, collect artifacts and logs, report the incident to the FBI and USSS, and apply the relevant countermeasures.

Source: The Hacker News