FBI and Secret Service: FortiBleed is still active and locking victims out
A joint FBI and USSS advisory says the FortiBleed credential campaign is still scanning FortiGate VPNs with stolen logins, and some victims are being locked out when attackers delete or change the original admin accounts. No CVE is involved.
The FBI and the U.S. Secret Service published joint advisory JCSA-20261006-01 on October 6, warning that FortiBleed, the credential campaign against internet-facing FortiGate firewalls and SSL VPN gateways, is still running. Attackers continue to scan exposed Fortinet devices using previously stolen credentials. Some victims are locked out after attackers create their own admin accounts and then delete or change the original ones. The advisory cites SOCRadar's count of more than 86,644 compromised devices across 194 countries and says the campaign exploits reused or leaked credentials and legacy SHA-256 password storage, with hashes cracked on a GPU cluster. Access is resold to ransomware affiliates, including INC/Lynx and Payload. The advisory lists attacker IP addresses and rogue account names such as forticloud-sync and support_fortinet. No vulnerability is involved.
Why it matters
This is pure identity failure on network gear: reused passwords, no MFA on admin and VPN logins, and weak hash storage that turns one config leak into plaintext. We covered how the operators then used the firewall itself to sniff credentials in our June FortiBleed report.
The agencies' list is the checklist: remove internet admin access, terminate all admin and VPN sessions, reset VPN and admin passwords, require phishing-resistant MFA on remote access and admin accounts, switch admin password storage to PBKDF2 (FortiOS 7.2.11 and later), and review REST API keys. Before resetting, check for the listed account names and make sure you still hold a working admin account, or the reset may lock you out instead of them.
Source: The Hacker News
Related on Start with Identity
- BlogAccess broker k0t breached FortiGate and GlobalProtect edges and exposed more than 70,000 credentials
Group-IB and NyxLab reported on October 21 that k0t, a likely initial access broker, broke into Fortinet and Palo Alto edge devices with known CVEs and brute fo
- BlogPEERSTITCH implant tags FortiOS VPN sessions to skip security checks
Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with C
- BlogQilin and INC use the GlobalProtect auth bypass to skip MFA, then dump domain controller disks
Unit 42's October 19 update says Qilin and INC ransomware operators are exploiting CVE-2026-0257 in PAN-OS GlobalProtect to open VPN sessions without MFA, then
- CVECheck Point Remote Access VPN lets attackers in without a password over IKEv1
A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid passwo
- CVECheck Point Security Gateway information disclosure of password hashes
An unauthenticated read on Check Point Security Gateways leaked password hashes, including those used for VPN and local admin. CISA KEV. May 2024. Hash disclosu
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,