FortiBleed Campaign Locks Victims Out of Fortinet Devices
Security authorities and threat intelligence firms warn that the ongoing FortiBleed campaign is actively locking organizations out of their Fortinet infrastructure by deleting user accounts and changing administrator passwords.
Radwan AbdulhadiEditor and technology writer
Overview of the Ongoing FortiBleed Campaign
The FortiBleed credential-harvesting and access-broker campaign remains active, with threat actors actively locking organizations out of their Fortinet devices. Initially targeting internet-accessible Fortinet FortiGate firewalls and SSL VPN appliances, the campaign began in June. According to reports from [says], the security community and intelligence researchers have been closely tracking the relentless spread and evolution of these targeted breaches.
Investigations into the campaign reveal that attackers leverage previously compromised credentials alongside brute-force techniques to hijack poorly protected hardware. Within just the first week, attacks managed to hit over [86,000 Fortinet devices] across numerous countries, drawing intense scrutiny from international security organizations and intelligence experts.
Scale of Compromised Infrastructure Worldwide
Following initial findings, threat intelligence firm SOCRadar confirmed that the total volume of impacted infrastructure stands at approximately 86,644 devices spread across 194 countries. The malicious actors systematically search for accessible firewalls, using harvested and cracked credentials to gain unauthorized entry.
Security analysts emphasize that this high figure represents verified, confirmed compromises rather than mere exposure estimates. Devices that were breached months ago continue to sit inside the threat actors' validated inventory, posing a persistent threat to corporate networks and government systems alike.
Methods Used to Lock Out Legitimate Administrators
In a joint advisory released by United States authorities, including the Federal Bureau of Investigation and the US Secret Service, officials warned that hackers are intentionally locking organizations out of their Fortinet appliances. This is achieved by systematically altering administrator passwords or outright deleting original accounts on the targeted systems.
By deleting existing accounts, the threat actors effectively block legitimate system administrators from accessing their own affected devices. This malicious maneuver ensures the attackers maintain long-term persistence on the compromised system while they attempt lateral movement deeper into the victim's enterprise environment.
Actor Tactics, Techniques, and Ransomware Links
Detailed analysis into the operations behind these attacks indicates that a [Russian initial access broker] has been heavily linked to the orchestration of the FortiBleed campaign. The malicious actors systematically scan for exposed SSL VPN portals, harvest credentials from infostealer logs, and crack hashed credentials offline.
Furthermore, operators have been observed mapping attack surfaces to successfully evade honeypots, validating credentials before taking over devices, and packaging working VPN configurations and target lists to sell to other cybercriminal entities and ransomware affiliates.
Vendor Insights and Response Mechanisms
Vendor investigations align with third-party findings, noting how attackers exploit legacy weaknesses and poor device protection. In [Fortinet’s analysis] of the intrusion vectors, researchers highlighted the dual use of credential stuffing, infostealer data, and heavy brute-force techniques to breach unprepared administrative panels.
As organizations scramble to understand the full impact of these incidents, security experts note that the exposure first came to light via unintended server leaks that exposed vast inventories of plaintext passwords and administrative login URLs.
Mitigation and Remediation Recommendations
To counter the ongoing threat, the FBI and USSS recommend that affected organizations immediately identify compromised hosts, carefully scope the extent of the intrusion, completely evict the attackers, harden protections, and report the breaches to the appropriate authorities.
Organizations are urged to reduce their overall attack surface by restricting management access, resetting all VPN and administrative passwords, implementing phishing-resistant multi-factor authentication (MFA), reviewing firewall users, validating API keys, scrutinizing system logs for suspicious behavior, and ensuring all credentials are securely stored.
Sources
- SecurityWeekFortiBleed Attackers Locking Victims Out of Fortinet Devices
- BleepingComputerFBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins
Continue chronologically
Related stories
Citrix, Fortinet, and Ivanti Patch 29 Security Vulnerabilities
Citrix, Fortinet, and Ivanti release vital security updates addressing 29 vulnerabilities, including critical execution and zero-day flaws.
Engineer Sentenced to Prison for Insider Cyber Extortion Plot
A former core infrastructure engineer has been sentenced to 32 months in federal prison for sabotaging his employer's industrial network.
CISA Warns SafePay Ransomware Hit 600+ Critical Groups
CISA and international law enforcement report that the SafePay ransomware gang has breached over 600 critical infrastructure organizations globally.
FBI Seizes Domain of Russian Bulletproof Host Virtualine
The FBI has seized the domain of Virtualine, a Russian-speaking bulletproof hosting provider linked to ransomware, infostealers, and illicit services.
