FortiBleed Attackers Locking Victims Out of Fortinet Devices

What it is

The FortiBleed campaign, an active credential-harvesting and access-broker operation against internet-accessible Fortinet FortiGate firewalls and SSL VPN appliances, running since June. It has compromised roughly 86,600+ devices across 194 countries. The FBI and US Secret Service issued a joint advisory this week on the lockout behavior.

How it works

Attackers scan for exposed SSL VPN portals, then harvest credentials from infostealer logs and prior breach dumps, crack hashed credentials offline, and map the attack surface to evade honeypots before using verified credentials to take over devices. Once in, some actors delete or change passwords on existing accounts — partly to lock out legitimate admins, partly to block remediation while they move laterally within the environment. Compromised access and working VPN configs/target lists are then sold to other threat actors, functioning as an access-broker market rather than a single actor's campaign.

flowchart LR
    A[Scan exposed SSL VPN portals] --> B[Harvest/crack credentials]
    B --> C[Compromise device with verified creds]
    C --> D{Account tampering?}
    D -->|Yes| E[Delete/change passwords -> owner locked out]
    D -->|No| F[Maintain stealthy persistence]
    C --> G[Sell access/configs to other actors]

Preconditions / Affected

Internet-accessible FortiGate firewalls and SSL VPN appliances with weak or reused credentials, or accounts matching prior breach dumps/infostealer logs, are at risk. SOCRadar's count is of confirmed-compromised devices, not an exposure estimate — devices breached months ago remain in the attackers' validated inventory even if not re-touched recently.

What to do

Per the FBI/USSS advisory: identify compromised hosts, scope the intrusion, evict the attackers, harden the environment, and report the intrusion. To reduce attack surface:

• Restrict management access to the device
• Reset all Fortinet VPN and administrative passwords
• Implement phishing-resistant MFA
• Review firewall and VPN users/configurations
• Review and validate API keys
• Review logs for suspicious activity
• Ensure credentials are stored securely

Caveats

The device-count figures (86,000+ / 194 countries) come from third-party tracking (SOCRadar) and Fortinet's own analysis, not independently verified by the article; SOCRadar explicitly notes this is a cumulative confirmed-compromise count, not a current live-exposure figure.