FBI and Secret Service: FortiBleed is still active and locking victims out

The FBI and the U.S. Secret Service published joint advisory JCSA-20261006-01 on October 6, warning that FortiBleed, the credential campaign against internet-facing FortiGate firewalls and SSL VPN gateways, is still running. Attackers continue to scan exposed Fortinet devices using previously stolen credentials. Some victims are locked out after attackers create their own admin accounts and then delete or change the original ones. The advisory cites SOCRadar's count of more than 86,644 compromised devices across 194 countries and says the campaign exploits reused or leaked credentials and legacy SHA-256 password storage, with hashes cracked on a GPU cluster. Access is resold to ransomware affiliates, including INC/Lynx and Payload. The advisory lists attacker IP addresses and rogue account names such as forticloud-sync and support_fortinet. No vulnerability is involved.

Why it matters

This is pure identity failure on network gear: reused passwords, no MFA on admin and VPN logins, and weak hash storage that turns one config leak into plaintext. We covered how the operators then used the firewall itself to sniff credentials in our June FortiBleed report.

The agencies' list is the checklist: remove internet admin access, terminate all admin and VPN sessions, reset VPN and admin passwords, require phishing-resistant MFA on remote access and admin accounts, switch admin password storage to PBKDF2 (FortiOS 7.2.11 and later), and review REST API keys. Before resetting, check for the listed account names and make sure you still hold a working admin account, or the reset may lock you out instead of them.

Source: The Hacker News