Attackers breach Fortinet and Palo Alto firewalls, exposing 70,000 credentials

1. Executive summary

A credential-harvesting campaign tracked as FortiBleed has extracted configuration files from internet-facing Fortinet FortiGate firewalls and cracked the stored administrator hashes, yielding verified working credentials for between 30,000 and 75,000 devices across 194 countries. A joint FBI and US Secret Service advisory reported in October 2026 puts the verified count at more than 86,644 compromised devices and confirms the campaign is still active, with attackers creating new accounts and deleting or changing existing ones to lock administrators out. The same reporting states the operators sell the resulting access to affiliates of the INC/Lynx and Payload ransomware groups after enumerating Active Directory and identifying privileged users. No CVE has been assigned: the intrusion uses valid credentials against exposed management and VPN interfaces, so patching alone does not remove the exposure. EMEA financial services firms running FortiGate SSL VPN or administrative interfaces reachable from the internet should treat any such device# 2. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

The operation is a credential-theft and access-brokerage campaign, not an exploitation of a software flaw. The confirmed steps, drawn from the FBI and Secret Service advisory as reported by Help Net Security and from the earlier Hudson Rock and Diachenko analysis, are:

1. Attackers scan internet-exposed Fortinet FortiGate firewalls and SSL VPN gateways.
2. They extract configuration files from reachable devices. FortiGate configuration files store administrator and user credential hashes.
3. Hashes are cracked offline on a GPU cluster (reported as 45 GPUs) managed with Hashtopolis and Hashcat.
4. Cracked credentials are enriched, sorted and validated. Scripts filter out honeypots, map organisations and prioritise high-value targets by revenue and network structure.
5. Attackers authenticate with the recovered credentials, including through credential stuffing and password spraying using earlier leak dumps and infostealer logs.
6. On the device they create new accounts not previously present, and in some cases delete existing accounts to lock the organisation out and hold persistence.
7. They enumerate Active Directory accounts, look for privileged users, and attempt lateral movement into the internal environment.
8. Access is sold to affiliates of the INC/Lynx and Payload ransomware groups.

Scale and impact figures differ by source and by date. Arctic Wolf reported verified working administrator credentials for 30,000 to 75,000 devices across 194 countries. Hudson Rock's analysis of the leaked dataset reported 21,632 unique domains, and The Register reported roughly 75,000 devices, about half of all internet-facing Fortinet firewalls per Shodan. SOCRadar, cited in the October FBI and Secret Service advisory, verified more than 86,644 compromised devices. Diachenko reported the operation processed 1.16 billion credential attempts against 320,777 FortiGate targets and 2.1 billion attempts against 163,650 MSSQL servers. The Register named multinationals in the leaked data including FoxConn, Samsung, Comcast, Siemens, Lenovo, FedEx, Accenture and Oracle; those organisations were not confirmed as compromised, only as having credentials present in the dataset.

Two facts matter for defenders. Kevin Beaumont, who verified the credentials, reported that many of the sampled devices were on fairly recent patches and that most compromised devices remained online. Patching therefore does not close this exposure; credential rotation and removal of internet reachability do.

The primary item also names Palo Alto Networks GlobalProtect firewalls as targeted and states that operators obtained access to numerous organisations worldwide and attempted further compromise of some victims. That Palo Alto element rests on the primary item alone and is not corroborated by the FortiBleed reporting in the related sources; treat it as single-sourced and unverified. The actor is described by Diachenko as a Russian-speaking group. No MITRE ATT&CK profile for this group is available, so the attribution is unconfirmed.

4. Mitigation & containment

P1, within 24 hours:

• Inventory every FortiGate and GlobalProtect device with an internet-reachable administrative or SSL VPN interface. For each, rotate all local administrator and VPN account passwords, then invalidate existing sessions.
• Audit local accounts on each device against your known administrator list. Disable or delete any account you did not create. The FBI and Secret Service advisory states attackers add accounts and delete or change existing ones, so a password reset alone may not restore access.
• Where a device cannot be confirmed clean, isolate it from the internet and rebuild from a known-good configuration rather than resetting in place. The advisory notes recovery may require steps beyond standard patching and password resets.
• Enable multi-factor authentication on all VPN and administrative logins.

P2, within 72 hours:

• Search authentication logs on FortiGate and GlobalProtect for logins from unexpected source addresses, logins to accounts you did not create, and account deletions or password changes you did not make.
• Hunt in Active Directory for enumeration of privileged accounts and for lateral movement originating from firewall management hosts in the days after any suspicious VPN login.
• Restrict management interfaces to a dedicated management network or allowlisted source addresses; remove SSL VPN portals that are not required.

P3, within 7 days:

• Apply current Fortinet firmware. This does not remediate stolen credentials but closes unrelated flaws on the same devices.
• Review third-party and remote-access contracts for notification and cooperation clauses where a managed service provider operates the affected edge devices.

5. Indicators of compromise

No atomic indicators (hashes, domains, IP addresses, file paths) are present in the source material. The FBI and Secret Service advisory is reported to include attacker IP addresses and usernames found on victim devices, but those values are not reproduced in the sources provided and must be obtained from the advisory itself.

Behavioural indicators:

6. Detection

The sources describe behaviours and log events but give no file artefacts, command-line strings, mutexes or filenames from the threat itself. A YARA rule built on product names or campaign names would detect reporting about the threat, not the threat, so none is emitted. The Sigma rule below targets the account-manipulation behaviour the FBI and Secret Service advisory describes.

title: FortiGate Local Administrator Account Created or Deleted
id: 7b1e4c2a-3f6d-4a8e-9c21-5d0f8a6b1e34
status: experimental
description: Detects creation or deletion of local administrator accounts on Fortinet FortiGate devices, behaviour associated with the FortiBleed campaign per the joint FBI and US Secret Service advisory.
author: Adverse Trace
date: 2026/10/23
references:

  - https://www.helpnetsecurity.com/2026/10/07/fortinet-fortibleed-campaign-fbi-advisory/
logsource:
  product: fortinet
  service: event
detection:
  selection_event:
    action:

      - 'Add'
      - 'Delete'
  selection_object:
    object:

      - 'admin'
      - 'system.admin'
  condition: selection_event and selection_object
falsepositives:

  - Legitimate administrator provisioning or deprovisioning
level: high

Field names in the logsource block should be mapped to your FortiGate syslog schema before deployment; the event and object values reflect FortiGate configuration-change logging and require validation against your firmware version.

7. Sources

• The Hacker News, "Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials", 2026-10-23. https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html
• SecurityWeek, "FortiBleed: 86,000 Fortinet Device Credentials Compromised". https://www.securityweek.com/fortibleed-86000-fortinet-device-credentials-compromised/
• DataBreaches.net, "Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries" (citing Arctic Wolf), 2026-06-18. https://databreaches.net/2026/06/18/active-fortibleed-campaign-impacting-fortinet-devices-across-194-countries/
• Help Net Security, "What the Fortibleed campaign means for organizations running FortiGate firewalls", 2026-06-23. https://www.helpnetsecurity.com/2026/06/23/fortibleed-investigation-remediation/
• The Register, "Massive password-stealing attack hits 75k Fortinet firewalls", 2026-06-17. https://www.theregister.com/cyber-crime/2026/06/17/massive-password-stealing-attack-hits-75k-fortinet-firewalls/5257877
• Help Net Security, "FortiBleed is still active, with attackers locking admins out of Fortinet firewalls" (citing joint FBI and US Secret Service advisory), 2026-10-07. https://www.helpnetsecurity.com/2026/10/07/fortinet-fortibleed-campaign-fbi-advisory/
• Help Net Security, "74,000 Fortinet firewall credentials exposed in FortiBleed data leak", 2026-06-18. https://www.helpnetsecurity.com/2026/06/18/fortinet-fortibleed-data-leak/

8. Adverse Trace position

Adverse Trace assesses this as a high-impact credential exposure rather than a software vulnerability: no CVE is assigned and no CISA KEV entry applies, so severity rests on the volume of verified working credentials and the confirmed onward sale of access to INC/Lynx and Payload ransomware affiliates. The Palo Alto GlobalProtect element is single-sourced to the primary item and unconfirmed; the Russian-speaking attribution and the ransomware-affiliate linkage rest on researcher and government reporting that we have not independently corroborated, and no MITRE ATT&CK profile exists for the group. Clients should assume any internet-facing FortiGate device is in scope until credential rotation and account auditing prove otherwise, and should not treat patching as remediation. Adverse Trace will obtain the IP and username indicators from the FBI and Secret Service advisory and issue them as a indicator update, and will monitor for confirmation of the Palo Alto targeting before extending the advisory to GlobalProtect estates.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.