The FBI and the US Secret Service warn that an ongoing criminal operation called FortiBleed is
breaking into internet-facing Fortinet FortiGate firewalls and remote-access (VPN) gateways by
guessing and cracking passwords, then selling that access to ransomware gangs. Attackers add their
own administrator accounts and sometimes delete the owners’ accounts, locking organisations out of
their own firewalls. Organisations using FortiGate should check for unknown admin accounts, reset all
VPN and administrator passwords, and enforce multi-factor authentication now
1. Campaign Timeline
On 6 October 2026, the FBI and USSS issued joint advisory JCSA-20261006-01, describing FortiBleed as ongoing and
noting attackers are still scanning exposed devices. The operation surfaced publicly in June 2026, when SOCRadar
reported 86,644 compromised Fortinet firewalls across 194 countries and CloudSEK analysed an open directory the
attackers accidentally exposed. Fortinet stated on 19 June 2026 that this is not a new Fortinet vulnerability. Attacker IP
addresses were observed between 18 June and 23 July 2026. No threat actor has been named.
2. Attack Chain
- Initial Access SCANNING AND PASSWORD ATTACKS: Attackers scan the internet for exposed FortiGate SSL VPN portals and use credential stuffing and password spraying against them. The advisory states they may have exploited SSH where the port was open.
- Credential Access: Attackers extracted FortiOS user databases and session tokens, and compromised devices continuously sent harvested credentials to attacker-controlled servers.
- Offline Cracking: Stolen legacy SHA-256 password hashes were fed into rented GPU infrastructure running Hashcat and Hashtopolis for distributed offline cracking.
- Persistence and Lockout: Attackers created new administrative accounts on the firewall and sometimes deleted or changed existing accounts, locking legitimate administrators out.
- Discovery and Lateral Movement: Using verified credentials, attackers enumerated Active Directory accounts and ran password spraying to find privileged accounts and expand access.
- Access Sale: The operators packaged working VPN configurations and target lists for sale as an initial-access broker. Access has reached ransomware affiliates, currently including INC/Lynx and Payload.
3. Adversary Toolkit
| TOOL / INDICATOR | TYPE | FUNCTION |
| Hashcat | Password cracking tool | GPU-accelerated offline cracking of stolen FortiOS password hashes. |
| Hashtopolis | Distributed cracking platform | Distributes Hashcat cracking jobs across the attacker’s GPU cluster. |
| Rented GPU infrastructure | Cloud compute | Acquired infrastructure hosting the cracking cluster. |
4. Indicators of Compromise (IOCs)
TYPE – INDICATOR
IP- 45.154.12[.]132
IP- 154.202.59[.]169
IP- 103.27.186[.]156
IP- 45.155.250[.]158
IP- 193.8.187[.]2
IP- 193.8.187[.]42
IP- 85.11.187[.]8
IP- 104.28.155[.]27
IP- 185.136.15[.]43
IP- 185.136.15[.]66
IP- 185.199.199[.]56
IP- 193.8.186[.]33
IP- 45.227.254[.]210
IP- 77.91.118[.]10
IP- 80.75.212[.]113
IP- 87.251.64[.]13
IP- 87.251.64[.]16
IP- 87.251.64[.]17
IP- 87.251.64[.]44
IP- 66.175.220[.]111
I NDICATORS OF ATTACK (IOA)
Rogue FortiGate admin account names: adminin, admin, forticloud-tech, gttadmin, Technical_support, my_admin,
fortiAdmin, fgtsecure, districtadmin, roadmin, adminsslvpn, support_fortinet, forticloud-sync, pakedge,
system_config, itadmin, IT_Manager, fgtsec, forti_support2. Accounts present that were not created by your team,
or existing accounts deleted or with changed passwords, indicate compromise. Attacker infrastructure uses ports
4332 and 4432 but usually beacons over HTTPS.
5. Recommendations
- Check every FortiGate for unknown admin or local accounts (such as forticloud-sync, support_fortinet, fgtsecure), unknown REST API keys, and unauthorised configuration changes.
- Terminate all administrative and VPN sessions, delete rogue accounts and API keys, then reset all VPN and administrator passwords, starting with internet-facing devices.
- Enforce PBKDF2 password hashing for administrator accounts (FortiOS 7.2.11 and later), remove legacy hashes, and require phishing-resistant multi-factor authentication on VPN and admin access.
- Remove internet-facing management by restricting admin access to trusted hosts or a local-in policy, close SSH, and review firewall, VPN, and domain controller logs for lateral movement.
- Monitor for the IOCs. Block the IOCs at their respective controls.
6. Sources
- https://www.ic3.gov/CSA/2026/261006.pdf
- https://socradar.io/blog/fortibleed-fortinet-firewalls-compromised/
- https://www.cloudsek.com/blog/inside-the-fortibleed-open-directory-a-technical-analysis-of
what-the-attacker-left-behind - https://www.fortinet.com/blog/psirt-blogs/analysis-of-reported-credential-compromise-of-for
tigate-devices
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.