Some of the organizations caught up in FortiBleed could no longer log in to their own firewalls. That detail, from a joint advisory the FBI and the United States Secret Service published on October 6, marks the point at which a credential theft campaign against FortiGate firewalls and the SSL VPN portals they expose stopped being something a password reset could fix. The agencies said the intruders create new administrator accounts and, in some cases, delete the original ones or change their passwords, locking administrators out while they keep control and probe the network behind the device.
The campaign is not built on a software flaw. Fortinet said in June that FortiBleed is not a new vulnerability in its products and is unrelated to any recent advisory, and that its analysis pointed to credentials reused from two earlier incidents plus brute force attempts against devices with weak passwords and no multifactor authentication. The FBI advisory cites SOCRadar's tally of more than 86,644 devices confirmed compromised in 194 countries, a figure the research firm describes as confirmed compromises rather than an estimate of exposure, and says the operators were still scanning exposed firewalls with previously stolen credentials in early October.
A cracking pipeline, exposed by its owners
The inner workings became visible because the attackers left their own backend server open on the internet. According to the advisory, the operation scans for reachable SSL VPN portals, then tries credentials from older Fortinet leaks and from infostealer logs through credential stuffing and password spraying. Password hashes pulled from compromised devices go to a rented GPU cluster running Hashcat and Hashtopolis for offline cracking. Scripts then weed out honeypots, work out which organization owns each device and sort the targets by the revenue and network behind them, after which the crew enumerates Active Directory and sprays for privileged accounts. The end product, usable VPN logins bundled with target lists, is sold on; the agencies said reporting indicates ransomware affiliates, including INC/Lynx and Payload, have bought that access.
The weak point that made cracking worthwhile is how older FortiOS builds store administrator passwords: as salted SHA256 hashes, which GPUs crack quickly. Fortinet moved to the slower PBKDF2 function in FortiOS 7.2.11, 7.4.8 and 7.6.1, but SOCRadar notes a catch. The stronger hash only replaces the old one when an administrator logs in again after the upgrade, and a hidden setting can keep the previous hash for backward compatibility, where any super_admin who exports a configuration backup can see it, and so can an attacker who gets hold of that backup. A firewall running patched firmware can therefore still hand over a crackable hash.
What the vendor and the agencies want done
Fortinet, CISA and the two agencies have been giving the same instructions since June, and they go well beyond installing updates:
- Terminate every administrative and VPN session, reset all VPN and administrator passwords, beginning with devices reachable from the internet, insist on long unique passwords, and require phishing resistant multifactor authentication on all accounts used for remote access or administration.
- Upgrade within the 7.4, 7.6 or 8.0 lines to builds that support PBKDF2 hashing, as Fortinet advised in June, have every administrator log in again so the stored hash is actually replaced, and follow Fortinet's guidance for removing the legacy password settings.
- Limit management access from outside to trusted hosts, better still through a local in policy, and best of all take administration off the internet entirely. Review REST API keys as well, since an unknown key stays valid after passwords are reset.
- Compare the running configuration with a known good copy and look for accounts nobody created. The advisory lists names found on victim devices, among them adminsslvpn, support_fortinet, fgtsecure, districtadmin and IT_Manager, and Fortinet adds forticloud and fortiuser. Then read the logs of the firewall itself, the VPN, the authentication systems and the domain controllers for signs of lateral movement and logins nobody can explain.
Why the edge keeps giving way
Edge appliances sit where a stolen password does the most damage. A FortiGate holds the VPN that leads inside, often a binding to Active Directory or LDAP, and a management interface that in tens of thousands of cases faced the open internet. CISA's catalog of known exploited vulnerabilities listed 31 Fortinet entries as of October 8, 8 of them added during 2026 and 14 flagged as used in ransomware campaigns, yet FortiBleed appears in none of them because it has no CVE of its own. A flaw is closed when the fix is installed. A leaked password stays valid until someone changes it, which is why Fortinet believes credentials taken during the FortiCloud single sign on bypass exploited in January 2026 were still opening doors months after the patch shipped.
Fortinet said in June it had identified potentially compromised systems and was contacting affected customers, and the agencies asked victims to report intrusions and not to pay ransoms. For anyone running an exposed FortiGate, the quickest test is also the plainest: list the administrator accounts and API keys on the device, and treat any entry nobody can vouch for as proof that someone else has already been there.
