FortiBleed Cyberattack Campaign: Threat Actors Compromise Fortinet Firewalls and Lock Organizations Out of Administrative Access

The ongoing FortiBleed cyberattack campaign continues to target Fortinet FortiGate firewalls and SSL VPN infrastructure, raising significant concerns about unauthorized administrative access and the security of internet-facing network appliances.

Since June 2026, threat actors have been exploiting previously compromised credentials and weak authentication practices to gain unauthorized access to vulnerable configurations.

A joint cybersecurity advisory issued by the Federal Bureau of Investigation (FBI) and the United States Secret Service (USSS) on October 6, 2026, revealed that attackers have been creating unauthorized administrative accounts, modifying existing credentials, and deleting legitimate accounts to prevent organizations from accessing their own security devices.

According to SOCRadar's threat intelligence findings, more than 86,644 compromised Fortinet devices have been verified across 194 countries.

The campaign demonstrates how credential-based attacks can compromise critical network security infrastructure and expose organizations to broader cyber threats.

The FortiBleed campaign primarily relies on the exploitation of previously exposed credentials and inadequate authentication controls rather than a newly discovered Fortinet software vulnerability.

Threat actors initially identify internet-accessible FortiGate management interfaces and SSL VPN gateways through automated reconnaissance activities.

They subsequently employ techniques such as credential stuffing, password spraying, and brute-force authentication attempts to identify valid credentials.

Technical investigations have also identified the use of GPU-accelerated password-cracking infrastructure, including Hashcat and Hashtopolis, to process stolen password hashes and recover usable credentials.

Once administrative access is established, attackers may create additional privileged accounts to maintain persistent access to compromised devices.

In certain incidents, legitimate administrative accounts are deleted or their passwords are changed, effectively preventing authorized personnel from managing their own firewalls.

The attackers have also been observed conducting Active Directory reconnaissance and attempting lateral movement into internal corporate networks.

Furthermore, the campaign operates within an Initial Access Broker (IAB) model, in which compromised network access and VPN configurations can be distributed or sold to other threat actors.

The FBI and USSS advisory identifies connections between access originating from the campaign and ransomware affiliates, including INC/Lynx and Payload.

Some measures we should take to protect against these types of attacks include:

• Administrative account compromise: Attackers can modify firewall configurations and prevent legitimate administrators from accessing critical security infrastructure.

• Persistent unauthorized access: Newly created privileged accounts and malicious API keys may allow attackers to maintain access after initial compromise.

• Lateral movement: Compromised VPN access can provide a starting point for attacks against Active Directory environments and internal business systems.

• Ransomware exposure: Stolen remote access credentials can be leveraged by ransomware affiliates to compromise additional assets.

• Operational disruption: Loss of administrative control over critical network security devices can complicate incident response and affect business continuity.

For detailed information, you can contact our experts at info@zerosecond.ae