FBI, Secret Service add to warnings of FortiBleed credential stealing campaign

1. Executive summary

The FBI and US Secret Service published a joint advisory on 2026-10-06 confirming that the FortiBleed credential-harvesting campaign remains active against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, with SOCRadar verifying more than 86,644 compromised devices across 194 countries. The operators use credentials from earlier breaches and infostealer logs for credential stuffing and password spraying, then extract password hashes from compromised devices and crack them offline on GPU-accelerated clusters. Victims can be locked out of their own firewalls when the actor deletes or changes passwords and creates new accounts for persistence. The advisory links the campaign to initial access brokers supplying access to ransomware affiliates, with current evidence pointing to INC/Lynx and Payload. No CVE is involved: this is abuse of valid credentials and legacy SHA-256 password storage, so patching does not close it.

2. Regulatory framing

No DORA Art. 24, 28, 29 or 30 mapping is claimed here. The campaign abuses credentials on the client's own estate; the sources do not describe a third-party provider failure or a concentration issue.

3. Technical analysis & attack chain

No CVE is exploited. The campaign works through valid accounts, reused or leaked credentials, and weaknesses in how FortiGate stores and exposes authentication data. The chain below is drawn from the joint advisory as reported by The Record, The Register, The Hacker News and BleepingComputer.

1. Reconnaissance. Operators scan the internet for exposed FortiGate SSL VPN portals and use automated scripts to identify reachable devices. An internal tracking file recovered from the operators recorded more than 20 affiliates in defined roles scanning thousands of FortiGate portals across more than 150 countries.
2. Credential acquisition. The actor assembles credentials from earlier breaches and infostealer logs. The advisory states the campaign exploits reused or leaked credentials and legacy SHA-256 password storage.
3. Credential stuffing and password spraying. Automated scripts submit the assembled credentials against the identified portals. The agencies describe the actor collecting large volumes of credentials and authentication artifacts at this stage.
4. Hash extraction and offline cracking. Password hashes are pulled from compromised devices and cracked offline using GPU-accelerated clusters. This is where legacy SHA-256 password storage matters: the storage format makes offline recovery of the plaintext practical once the hash is in hand.
5. Account creation and lockout. During the initial intrusion the actor creates new accounts that were not previously on the device. In some cases existing accounts are deleted, which locks the organisation out of its own firewall and holds persistence while the actor attempts lateral movement inside the environment.
6. Target sorting. Stolen credentials are sorted, validated and organised by victim organisation revenue or network structure. This is a prioritisation step, not a technical one, and it tells you the actor is selecting which victims to work or sell.
7. Monetisation and follow-on access. Access is either sold to other parties or used directly. Initial access brokers are offering access to ransomware affiliates tied to INC/Lynx and Payload. The advisory states the FortiBleed attack chain has been observed as an initial entry point for ransomware affiliates.

A custom sniffer is reported to have been used to harvest authentication secrets from compromised firewalls. BleepingComputer attributes this to SOCRadar. The sources do not give the sniffer's filename, hash, command line, or the interface or protocol it captures on, so no detection content can be built from it.

The campaign became visible to researchers and law enforcement after the operators exposed their own backend server. The FBI and Secret Service describe the recovered tooling and datasets as providing an end-to-end view of how the operators identified targets, validated stolen credentials, and expanded access inside victim networks. That is the agencies' characterisation of the material; the sources do not publish the tooling itself.

Confidence and attribution caveats. The 86,644-device figure and the 194-country figure come from SOCRadar's verification and are carried in the joint advisory; treat them as single-vendor telemetry endorsed by the agencies rather than independently reproduced counts. The link to INC/Lynx and Payload rests on SOCRadar's July study and The Register's prior reporting on that connection. The 12 confirmed ransomware attacks stemming from FortiBleed is SOCRadar's figure from July. The claim that Russian hackers used the campaign to break into email accounts of UK government officials is reported by The Record and is not attributed in the sources to a named actor with a MITRE ATT&CK profile; treat it as unconfirmed attribution. No MITRE ATT&CK group profile is available in the verified reference data for INC, Lynx or Payload, so all three are named as reported by the sources and are not mapped to tracked groups here.

4. Mitigation & containment

P1 within 24 hours

• Remove internet-facing administrative access to FortiGate management interfaces. The advisory's first recommendation is to restrict external management of devices or remove internet administration altogether. Where remote management is operationally required, restrict it to named source addresses and a management path that is not the SSL VPN portal.
• Enumerate every account on every FortiGate device and verify each one is legitimate. The agencies specifically direct organisations to review all Fortinet accounts and verify their legitimacy. Any account that cannot be tied to a named person or a documented service is a candidate for the actor's persistence and should be disabled after evidence is captured.
• Terminate all active administrative and VPN sessions. The advisory calls for terminating active admin and VPN sessions, not only resetting credentials. A password reset that leaves a live session intact does not evict the actor.
• Reset credentials for all FortiGate administrative and VPN accounts, and reset any credential that was reused on the firewall and elsewhere. Because the campaign runs on reused credentials, a firewall-only reset leaves the same password valid on every other system that shares it.
• Enable phishing-resistant multi-factor authentication on FortiGate administrative and VPN access. The advisory names phishing-resistant MFA specifically. TOTP-only MFA is a weaker control against an actor that already holds a valid password and is not what the agencies asked for.

P2 within 72 hours

• Check for lockout risk before you act. If the actor has already deleted accounts or changed passwords, a routine reset can complete the lockout. Confirm you hold out-of-band console or physical access to each device, and a current configuration backup, before making account changes.
• Rotate any secret that was stored on or passed through the firewall. The campaign harvested authentication artifacts, not only passwords. VPN pre-shared keys, certificates and any credential the device held should be treated as exposed.
• Hunt for the actor's created accounts. Compare the current local account list against a known-good baseline or configuration backup. Accounts present now that are absent from the baseline are the actor's persistence and should be disabled and their activity reviewed.
• Review FortiGate authentication logs for the full campaign window for successful logins from unexpected source addresses, logins outside business hours, and bursts of failed authentications consistent with spraying. The sources do not give a log field mapping or a specific event ID, so scope the review by account and source address rather than by signature.

P3 within 7 days

• Plan the move off legacy SHA-256 password storage on FortiGate devices. The advisory names legacy SHA-256 password storage as a factor in the campaign. This is a configuration and platform decision, and the sources do not name a specific setting or firmware version that changes it, so confirm the supported option with Fortinet for your model and firmware before scheduling the change.
• Treat FortiBleed access as a possible precursor to ransomware. The advisory links the campaign to ransomware affiliates. If you find evidence of FortiBleed access, extend the investigation into the internal network rather than closing it at the firewall.
• Do not pay a ransom. The FBI and Secret Service warned against paying ransoms in this advisory.
• Report incidents. The agencies encouraged victims to report. The advisory notes organisations are not obliged to provide information in response to it; that is a statement about the voluntary nature of the request, not a statement about your DORA or NIS2 reporting duties, which are separate.

5. Indicators of compromise

No indicators of compromise available in the source material. The sources describe the campaign at the level of technique and outcome and publish no hashes, domains, IP addresses, file paths, account names or command lines.

The sources do describe observable behaviours. These are not atomic indicators and are not machine-pivotable, so they are listed separately and are not included in a copyable block.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

The sources name no file, hash, mutex, scheduled task, service, registry key, command-line flag or network artefact belonging to the campaign. The only named tool is a "custom sniffer" with no filename, no hash and no described behaviour beyond harvesting authentication secrets. A YARA or Sigma rule built from what is available here would match reporting about the campaign rather than the campaign itself, so none is emitted.

The detection work that is possible from this material is behavioural and belongs in log analytics rather than in signature content: alert on FortiGate local account creation outside a change window, on administrative or VPN session establishment from a source address not seen before for that account, and on a successful authentication preceded by a high-volume failed-authentication burst across multiple accounts from the same source.

7. Sources

• The Record, "FBI, Secret Service add to warnings of FortiBleed credential stealing campaign", https://therecord.media/fortibleed-warning-fbi-secret-service, 2026-10-07.
• The Register, "FortiBleed still a bleeding nuisance as FBI confirms ongoing attacks", https://www.theregister.com/security/2026/10/07/fortibleed-still-a-bleeding-nuisance-as-fbi-confirms-ongoing-attacks/5301585, 2026-10-07.
• The Hacker News, "FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials", https://thehackernews.com/2026/10/fbi-warns-fortibleed-remains-active.html, 2026-10.
• BleepingComputer, "FortiBleed campaign used custom FortiGate sniffer to steal credentials", https://www.bleepingcomputer.com/news/security/fortibleed-campaign-used-custom-fortigate-sniffer-to-steal-credentials/.
• BleepingComputer, "FortiBleed credential-theft campaign linked to Lynx ransomware", https://www.bleepingcomputer.com/news/security/fortibleed-credential-theft-campaign-linked-to-lynx-ransomware/.
• Dark Reading, "Sweeping Credential-Harvesting Heist Compromises +30K Fortinet Devices", https://www.darkreading.com/cyberattacks-data-breaches/sweeping-credential-harvesting-heist-compromises-30k-fortinet-devices.
• Cybersecurity Dive, "CISA urges device hardening after thousands of Fortinet credentials compromised", https://www.cybersecuritydive.com/news/cisa-device-hardening-thousands-fortinet-credentials-compromised/823397/.

8. Adverse Trace position

Adverse Trace assesses this as a high-impact, low-complexity campaign against EMEA financial services clients that expose FortiGate SSL VPN or management interfaces to the internet. There is no CVE to patch and no vendor fix that closes it: the exposure is valid credentials, legacy SHA-256 password storage, and internet-reachable management, which means the remediation is configuration and identity work that many clients have deferred. The lockout behaviour raises the operational risk above a normal credential compromise, because the recovery path runs through access the actor may already have removed. We treat the 86,644-device and 194-country figures as SOCRadar telemetry endorsed by the joint advisory, and the INC/Lynx and Payload links as single-sourced to SOCRadar; no MITRE ATT&CK profile exists in our reference data for those names, so we are not mapping them to tracked groups. We will pull the joint advisory PDF and re-issue if it contains account names, hashes or sniffer detail that would let us author detection content, and we will confirm with Fortinet which firmware and settings change the SHA-256 password storage behaviour before we advise clients to schedule that change. Clients who find FortiGate accounts they cannot account for should contact us before disabling them, so the account list is captured as evidence first.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.