FortiBleed Campaign Reportedly Compromised More Than 86,000 Devices

The FBI and U.S. Secret Service have warned that the FortiBleed credential-compromise campaign affected more than 86,644 Fortinet devices across 194 countries, according to a joint advisory described in materials shared with Enterprise Security Tech.

The campaign targets internet-facing FortiGate firewalls and SSL VPN gateways using credentials from previous leaks and infostealer logs, as well as password spraying and credential stuffing. Attackers reportedly send stolen password hashes to distributed GPU infrastructure for cracking.

After access, operators create administrator accounts, enumerate Active Directory and search for privileged credentials. Some victims were locked out after legitimate accounts were changed or deleted. The access was then packaged and sold to other criminals, including ransomware affiliates.

Patching alone is not enough when credentials or administrative accounts may already be compromised. Defenders should audit device accounts and configuration changes, rotate exposed credentials, require multifactor authentication, restrict management interfaces and investigate potential lateral movement.