FortiBleed (Threat actor): news timeline & CVEs

FortiBleed Attack Campaign Exploiting Fortinet Firewalls and VPNs – FBI Warns

FBI warns FortiBleed compromised over 86,000 Fortinet firewalls and VPNs in 194 countries.

The FBI and U.S. Secret Service warned that the ongoing FortiBleed campaign is compromising internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, reportedly affecting more than 86,644 devices across 194 countries. It is not a single new Fortinet vulnerability: operators reuse leaked or weak credentials, crack legacy SHA-256 hashes, and sell verified access. After entry they may create administrator accounts, disable or delete legitimate admins, and enumerate Active Directory. The advisory links the activity to initial-access brokers supporting INC/Lynx and Payload ransomware.

Cyber Security Newsupdated Oct 8, 11:44 UTC · 13h agofirst Oct 7, 13:19 UTC · 1d agoThreat actor in the wild 13 sources1

FBI Warns FortiBleed Campaign Targeting Fortinet Firewalls and VPNs to Steal Credentials

FBI warns FortiBleed operators compromised over 86,000 Fortinet firewalls and VPNs to steal credentials for ransomware brokers.

The FBI and U.S. Secret Service warned on October 6, 2026 that FortiBleed operators are compromising internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. SOCRadar verified more than 86,644 affected devices across 194 countries. Attackers reuse leaked credentials, crack legacy SHA-256 hashes with Hashcat, steal session tokens, and create rogue administrator accounts that can lock out defenders. Initial-access brokers using the chain have reportedly supplied access to ransomware affiliates INC/Lynx and Payload.

GBHackersupdated Oct 8, 11:44 UTC · 13h agofirst Oct 7, 12:44 UTC · 1d agoThreat actor in the wild 13 sources1

FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials

FBI and Secret Service warn FortiBleed is still harvesting Fortinet firewall credentials, with 86,644 logins tied to ransomware access brokers.

The FBI and U.S. Secret Service warned that FortiBleed, a Russian-speaking campaign against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, remains active. As of June 19, 2026 it had collected 86,644 working device credentials across 194 countries by stuffing and spraying leaked or infostealer passwords, then using the Go tool FortigateSniffer to capture hashes for offline GPU cracking. Attackers add new firewall administrator accounts, sometimes delete original accounts to lock victims out, and move laterally through Active Directory, Kerberos, and SMB before stealing files and session cookies. Overlaps with INC and Lynx ransomware indicate an initial-access broker is selling the access; CISA has urged phishing-resistant MFA, session termination, password resets, and PBKDF2 storage.

The Hacker Newsupdated Oct 8, 11:44 UTC · 13h agofirst Oct 7, 11:56 UTC · 1d agoThreat actor in the wild 13 sources

FortiBleed Is Still Active, Locking Organizations Out

FBI and Secret Service say the FortiBleed credential-compromise campaign remains active and is locking organizations out.

On October 6, 2026, the FBI and the U.S. Secret Service published a joint cybersecurity advisory on FortiBleed. The advisory says the global credential-compromise campaign is still active. Reporting on the advisory says the activity is locking organizations out of affected systems.

SOCRadarupdated Oct 8, 11:44 UTC · 13h agofirst Oct 7, 11:51 UTC · 1d agoThreat actor in the wild 13 sources1

FortiBleed

Timeline4 articles

Appears with

FortiBleed Attack Campaign Exploiting Fortinet Firewalls and VPNs – FBI Warns

FBI Warns FortiBleed Campaign Targeting Fortinet Firewalls and VPNs to Steal Credentials

FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials

FortiBleed Is Still Active, Locking Organizations Out