OTX-6ac679e7bbe47190f9ffce7a
info
📛 Threat Title
FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts
Description
FortiBleed is an active global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, with over 86,644 compromised devices verified across 194 countries. The campaign exploits reused or leaked credentials and legacy SHA-256 password storage, enabling threat actors to harvest and crack authentication data at scale using distributed GPU clusters. Attackers scan for exposed FortiGate SSL VPN portals, collect credentials through stuffing and password spraying, and crack stolen password hashes offline. Once access is gained, they create new administrative accounts for persistence and conduct Active Directory enumeration to expand access. Affected organizations may experience lockouts as threat actors delete or modify existing accounts. The operation functions as an initial-access broker, with connections observed to INC/Lynx and Payload ransomware affiliates, representing a significant threat requiring immediate defensive action.
Indicators of Compromise (0)
No indicators of compromise on this threat.
References (2)
-
OTX pulse
AlienVaulkt OTX
FortiBleed is an active global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, with over 86,644 compromised devices verified across 194 countries. The campaign exploits reused or leaked credentials and legacy SHA-256 password storage, enabling threat actors to harvest and crack authentication data at scale using distributed GPU clusters. Attackers scan for exposed FortiGate SSL VPN portals, collect credentials through stuffing and passw
- reference AlienVaulkt OTX
Remediations (10)
-
web:cybersecuritynews.com
The FBI and U.S. Secret Service have issued a joint cybersecurity advisory warning that the ongoing FortiBleed campaign is targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways worldwide. The credential-compromise operation has reportedly affected more than 86,644 devices ...
-
web:labs.cloudsecurityalliance.org
Key Takeaways The FBI and U.S. Secret Service attribute FortiBleed primarily to credential reuse and weak password storage rather than to a specific software vulnerability [1].
-
web:radar.offseq.com
FortiBleed is an ongoing global campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. It exploits reused or leaked credentials and legacy SHA-256 password storage to harvest and crack authentication data at scale. Attackers gain access by scanning for exposed SSL VPN portals, performing credential stuffing and password spraying, and cracking stolen password ...
-
web:threatbeat.com
A new joint cybersecurity advisory developed by the Federal Bureau of Investigation (FBI) and the U.S. Secret Service (USSS) provides information and disseminates indicators of compromise (IOCs) related to the ongoing FortiBleed compromise. FortiBleed is an active, global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and secure socket layer (SSL) virtual ...
-
web:trustlist.uk
Cisco Meraki hardening release covers seven flaw classes, top score 9.6 Sources FBI and US Secret Service: joint advisory JCSA-20261006-01, FortiBleed Operations Continue Targeting Exposed Systems , 6 October 2026 CyberScoop: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks, 6 October 2026
-
web:www.cisa.gov
Update June 22, 2026: CISA has updated this Alert to incorporate the link to Fortinet's recent guidance on this activity. CISA is aware of global reports that malicious cyber actors have targeted internet-accessible Fortinet devices across government and private sector organizations using compromised credentials. This activity, referred to as FortiBleed , involves the exposure of leaked ...
-
web:www.ic3.gov
FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts Publication: October 6, 2026 U.S. Federal Bureau of Investigation United States Secret Service
-
web:www.linkedin.com
The advisory, FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts , says attackers are continuing to scan exposed Fortinet firewalls using credentials obtained ...
-
web:www.newsbreak.com
A new joint cybersecurity advisory developed by the Federal Bureau of Investigation (FBI) and the U.S. Secret Service (USSS) provides information and disseminates indicators of compromise (IOCs) related to the ongoing FortiBleed compromise. FortiBleed is an active, global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and secure socket layer (SSL)...
-
web:www.theregister.com
The FBI and US Secret Service (USSS) say criminals using credentials linked to the FortiBleed campaign are locking organizations out of their Fortinet firewalls. The agencies published a joint advisory on Tuesday, citing SOCRadar's verification of more than 86,644 compromised devices across 194 countries. "Based on initial responses, some victims may get locked out of their Fortinet devices if ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.