Payload (Organization): news timeline & CVEs

FortiBleed hit 86,000 firewalls by exploiting something nobody can patch away

FBI and Secret Service say FortiBleed credential campaign compromised 86,644 Fortinet FortiGate firewalls across 194 countries, selling access to ransomware affiliates.

The FBI and U.S. Secret Service issued a joint advisory on FortiBleed, a credential-harvesting campaign that has compromised 86,644 Fortinet FortiGate devices across 194 countries per SOCRadar verification. Attackers scan for exposed SSL VPN portals, run credential stuffing and password spraying with leaked credentials and infostealer logs, and crack harvested hashes on GPU clusters using Hashcat and Hashtopolis. Victims face lockout as actors delete or change admin passwords and create rogue accounts; stolen access is sold to initial access brokers serving INC/Lynx and Payload ransomware affiliates. Mitigations include removing internet-facing administration, resetting credentials, phishing-resistant MFA, and migrating legacy SHA-256 password storage to PBKDF2 on FortiOS 7.2.11 and later.

Security Affairsupdated Oct 8, 11:44 UTC · 14h agofirst Oct 7, 13:49 UTC · 1d agoThreat actor in the wild 13 sources1

FortiBleed is still active, with attackers locking admins out of Fortinet firewalls

FBI and Secret Service warn FortiBleed attackers continue compromising Fortinet firewalls — 86,644 devices verified — locking admins out and selling access to ransomware affiliates.

A joint FBI and U.S. Secret Service advisory says FortiBleed actors continue scanning internet-exposed FortiGate firewalls and SSL VPN gateways using credentials from prior Fortinet leak dumps and infostealer logs. SOCRadar has verified more than 86,644 compromised devices across 194 countries, and some victims are locked out when attackers delete or change original admin accounts and create new ones for persistence. The actors crack extracted password hashes on GPU clusters using Hashcat and Hashtopolis, enumerate Active Directory for privileged users, and sell access to INC/Lynx and Payload ransomware affiliates. The agencies warn recovery may require remediation beyond standard patching and password resets.

Help Net Securityupdated Oct 8, 11:44 UTC · 14h agofirst Oct 7, 13:43 UTC · 1d agoExploit / PoC in the wild 13 sources

FortiBleed still a bleeding nuisance as FBI confirms ongoing attacks

FBI and Secret Service confirm ongoing FortiBleed attacks on 86,644 Fortinet devices across 194 countries, with INC/Lynx and Payload ransomware affiliates using stolen access.

A joint FBI and US Secret Service advisory confirms criminals using FortiBleed-linked credentials are compromising internet-facing FortiGate firewalls and SSL VPN gateways, with SOCRadar verifying 86,644 compromised devices across 194 countries. Attackers use credential stuffing, password spraying, and GPU-accelerated offline hash cracking, then create new accounts for persistence while locking out legitimate administrators. Initial access brokers supplied network access to ransomware affiliates, with INC/Lynx and Payload implicated and at least 12 confirmed ransomware attacks. Agencies recommend restricting internet-facing management access, terminating active sessions, resetting passwords, and enabling phishing-resistant MFA.

The Register · Securityupdated Oct 8, 11:44 UTC · 14h agofirst Oct 7, 10:52 UTC · 1d agoExploit / PoC in the wild 13 sources

PAYLOAD Ransomware Hijacks Active Directory GPO to Disrupt Entire Windows Domain Without Encryption

PAYLOAD ransomware crew hijacked Active Directory GPOs to disrupt a Middle East manufacturer's entire Windows domain without encrypting files.

Kaspersky detailed an April 2026 PAYLOAD operation against a Middle East manufacturing firm that entered through a FortiGate SSL VPN using a compromised domain account. Attackers linked a malicious GPO named PAYLOAD to the AD domain root to push ransom notes, wallpapers, a 'Welcome to Payload!' logon banner, and disable the local Administrator account, while a second GPO ('win Firewall Off') disabled Windows Firewall across all profiles. No files were encrypted and no binaries were deployed; persistence came from the GPO link itself, with payload.jpg and hello.txt staged in SYSVOL. Data exfiltrated before the disruption was later published on a dark-web leak site, an encryptionless extortion model.

Cyber Security NewsSep 21, 14:03 UTC · 17d agoRansomware

Payload

Timeline4 articles

Appears with

FortiBleed hit 86,000 firewalls by exploiting something nobody can patch away

FortiBleed is still active, with attackers locking admins out of Fortinet firewalls

FortiBleed still a bleeding nuisance as FBI confirms ongoing attacks

PAYLOAD Ransomware Hijacks Active Directory GPO to Disrupt Entire Windows Domain Without Encryption