FBI Warns 'FortiBleed' Campaign Still Active After Harvesting 86,644 Fortinet Device Credentials

The FBI and the US Secret Service have warned that a massive credential-harvesting campaign against Fortinet network devices is still active — and patching alone will not stop it. In a joint advisory issued on October 6, the agencies said the campaign, tracked as "FortiBleed," has amassed working administrator credentials for 86,644 Fortinet devices across 194 countries.

That count, verified by threat-intelligence firm SOCRadar, covers FortiGate firewalls and SSL VPN gateways — the appliances that sit at the front door of corporate networks.

There is no CVE attached to this one. FortiBleed exploited no new software flaw. Instead, attackers built the campaign on the oldest trick in the book: credentials that were already out there — reused, leaked, or protected by weak password hashing that nobody got around to replacing.

The operation, first documented by SOCRadar and Hudson Rock in June 2026, works in stages. Attackers scan the internet for exposed FortiGate SSL VPN portals, then run password spraying and credential stuffing using data from previous leaks and infostealer logs.

Once inside, they pull FortiOS user databases and feed the legacy SHA-256 password hashes into a distributed GPU cracking pipeline built on tools like Hashcat and Hashtopolis.

A custom Go-based tool the agencies describe as a "FortigateSniffer" intercepts authentication traffic across dozens of protocols to harvest even more credentials in transit, which are then fed back into the scanners to compromise further targets.

In some incidents, the intruders create rogue administrator accounts with convincing service-account names — and in others, they delete or change the passwords of the original accounts, locking the legitimate owners out of their own equipment.

The irony was not lost on investigators: the operators themselves accidentally exposed their backend through an open directory, letting analysts see how targets were selected and how stolen access was packaged for sale.

The scale alone would be bad enough, but the credential stash is being converted into real intrusions. SOCRadar confirmed to The Hacker News that at least 12 ransomware deployments have already stemmed from FortiBleed-derived access, with hundreds of endpoints encrypted.

A Russian-speaking initial-access broker stands behind much of the campaign, selling working VPN configurations and target lists to other criminal actors — with access linked to affiliates of the INC, Lynx and Payload ransomware operations.

Because firewalls and VPN appliances sit at the network's front door — regulating connections, enforcing access policies and providing remote access — an administrative foothold there lets attackers manipulate security rules and pivot deep into internal systems.

The uncomfortable detail in the advisory is the mechanism that keeps the campaign alive even on fully patched devices. When organizations upgrade FortiOS, legacy SHA-256 password hashes remain in place until each administrator manually logs in again.

Systems upgraded months ago but whose administrators never re-authenticated are still vulnerable to offline hash cracking — patching fixed nothing for them.

CISA has urged Fortinet customers to enable phishing-resistant multi-factor authentication, terminate active SSL VPN and administrative sessions, reset VPN and administrator passwords, switch credential storage to the PBKDF2 algorithm, and review logs for suspicious activity.

And the agencies stress the point Fortinet shops least want to hear: this time, the question is not whether the latest update is installed — it is whether the attackers still have working access.