The FBI and U.S. Secret Service have issued a joint cybersecurity advisory warning that the FortiBleed credential-harvesting campaign continues to target organizations worldwide. The operation has compromised tens of thousands of Fortinet devices, with attackers using stolen credentials to gain network access, establish persistence, and support ransomware operations.
According to the October 6, 2026 advisory, security intelligence firm SOCRadar verified more than 86,644 compromised FortiGate devices across 194 countries. The campaign targets internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, using previously leaked credentials, password spraying, and offline password cracking to gain access.
What distinguishes FortiBleed is the infrastructure behind the operation. Investigators uncovered an organized process for collecting, cracking, validating, and distributing credentials, providing insight into how stolen authentication data becomes a resource for further attacks.
The FortiBleed campaign came to light after attackers inadvertently exposed their own backend server. The discovery gave researchers and law enforcement visibility into the tools, datasets, and processes used to identify vulnerable targets and obtain access to corporate networks.
Rather than relying on a newly discovered software vulnerability, attackers targeted internet-accessible Fortinet systems using credentials obtained from previous breaches and infostealer logs.
Automated tools scanned for exposed FortiGate SSL VPN portals and attempted authentication through credential stuffing and password spraying. Once attackers gained access, they collected additional authentication information, including FortiOS user databases, password hashes, and session tokens.
The stolen password hashes were processed through a distributed, GPU-accelerated cracking infrastructure using tools such as Hashcat and Hashtopolis. This allowed attackers to recover plaintext passwords from hashes protected by weaker legacy storage methods.
Recovered credentials were then organized and validated to determine which accounts provided working access. The FBI reports that attackers filtered out honeypots, mapped victim organizations, and prioritized targets based on factors including revenue and network structure.
The result was a coordinated operation capable of turning large volumes of exposed authentication data into verified access to corporate environments.
The FBI advisory describes how attackers used validated credentials to move beyond initial access.
After compromising FortiGate devices, attackers created unauthorized administrative accounts to maintain access. In some cases, they changed passwords or deleted legitimate accounts, preventing administrators from accessing their own systems.
These lockouts are a significant development highlighted in the advisory. Organizations responding to a suspected compromise may discover that attackers have modified account configurations and established alternative methods of access.
Restoring control requires more than resetting the credentials initially used in the attack. Security teams must also identify unauthorized accounts, review configuration changes, invalidate active sessions, and determine whether attackers accessed additional systems.
The campaign also involved Active Directory enumeration and password spraying within compromised environments.
Once attackers obtained network access, they searched for additional accounts and privileged identities that could provide broader access. These activities created opportunities to move beyond the original Fortinet device and into systems supporting enterprise authentication and operations.
For organizations using Active Directory, this progression is particularly relevant. Compromised network access can expose internal identity infrastructure to additional credential attacks, increasing the importance of identifying vulnerable accounts throughout the environment.
FortiBleed also demonstrates the relationship between credential harvesting and the market for initial network access.
According to the FBI advisory, attackers packaged compromised VPN configurations and validated access for resale to other threat actors. The campaign has been observed providing an initial entry point for ransomware affiliates, including those associated with INC/Lynx and Payload ransomware.
This arrangement allows different criminal groups to specialize in separate stages of an intrusion.
One group focuses on identifying exposed systems, collecting credentials, and confirming access. Other groups can then acquire that access and use it to conduct additional attacks, including ransomware deployment.
The value of a compromised credential therefore extends beyond the organization where it was originally exposed. Valid authentication information can be collected, tested, and reused by multiple actors, sometimes long after the initial exposure occurred.
The FortiBleed findings show how attackers have developed infrastructure to make this process repeatable and commercially valuable.
For security teams, the concern is not limited to detecting a single unauthorized login. It includes understanding whether exposed credentials have enabled additional accounts, persistent access, or activity elsewhere in the network.
The joint advisory outlines several measures organizations should take to investigate potential FortiBleed activity and strengthen affected environments.
The FBI and U.S. Secret Service recommend restricting external management access to Fortinet devices, terminating active administrative and VPN sessions, and resetting affected credentials.
Organizations should also enforce phishing-resistant multifactor authentication, review firewall and VPN configurations for unauthorized changes, and verify that unknown accounts or API keys have not been introduced.
The advisory emphasizes reviewing authentication logs, firewall activity, and domain controller records to identify suspicious access and potential lateral movement.
For credential storage, the agencies recommend stronger password hashing practices, including the use of PBKDF2 rather than legacy SHA-256 configurations on affected Fortinet systems.
These recommendations reflect the scope of the operation. FortiBleed involves credential compromise, unauthorized account creation, persistence, and potential access to additional systems. Addressing the incident requires security teams to investigate each of these areas rather than treating the initial login as an isolated event.
FortiBleed illustrates the operational advantage attackers gain from access to previously exposed passwords.
The campaign relied in part on credentials collected from earlier leaks and infostealer activity. Attackers used that information to identify working accounts and establish access without necessarily exploiting a new software vulnerability.
This creates a practical challenge for enterprise password security. Organizations need visibility into whether passwords currently in use have appeared in known credential exposures, including those discovered after the passwords were originally established.
For Active Directory environments, compromised password screening and ongoing monitoring can help address this risk.
Enzoic for Active Directory checks passwords against known compromised credentials during password changes and continuously monitors existing passwords for newly identified exposures. When compromised passwords are detected, organizations can apply remediation policies to address affected accounts.
These capabilities complement the network hardening, MFA, credential resets, and incident response measures recommended in the FBI advisory. They are not a replacement for those controls or a direct solution for securing Fortinet appliances.
Instead, compromised password detection helps organizations address one of the credential risks that operations such as FortiBleed seek to exploit.
The FortiBleed investigation offers a detailed look at the infrastructure supporting modern credential attacks. Attackers collected credentials from multiple sources, used automated tools to validate access, cracked password hashes at scale, and established persistence in compromised environments.
The FBI’s findings also demonstrate how access obtained through credential attacks can become a resource for additional intrusions and ransomware operations.
For organizations, the response must account for both the systems attackers initially target and the credentials they may attempt to exploit afterward.
Strengthening authentication, investigating unauthorized access, and identifying compromised passwords across enterprise identity environments all have a role in reducing that exposure.
Learn how Enzoic for Active Directory helps organizations identify compromised passwords and strengthen Active Directory password security.