FBI Warns FortiBleed Campaign Still Targets Fortinet Devices, Links to Ransomware Attacks
Summary
The FBI and Secret Service say FortiBleed remains active against internet-facing Fortinet devices, using stolen credentials to maintain access and support ransomware operations. They urge organizations to secure accounts, investigate devices, and restrict external admin
Key points
- The FBI and Secret Service report continued scanning of internet-facing Fortinet FortiGate firewalls and SSL VPN gateways using previously compromised credentials.
- The operation reportedly harvested more than 86,644 working device credentials across 194 countries by June 19, 2026.
- Attackers use credential stuffing and password spraying, then deploy a Go tool to capture authentication traffic and harvest credentials and password hashes.
- Cracked credentials have enabled deeper network access, new firewall accounts for persistence, and—in some cases—victim lockouts.
- SOCRadar says it confirmed at least 12 ransomware deployments linked to FortiBleed-derived access, including activity associated with INC, Lynx, and Payload ransomware operations.
- Recommended steps include restricting external administration, enforcing phishing-resistant MFA, terminating active sessions, rotating VPN and admin credentials, auditing accounts and logs, and investigating downstream activity.
Article Details
- Event Type
- Active credential-harvesting and access campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, with access reportedly supplied to ransomware operations.
- Impact
- The operation is estimated to have obtained more than 86,644 working device credentials across 194 countries. SOCRadar reported at least 12 ransomware deployments linked to the access, resulting in hundreds of encrypted endpoints. Victims may also lose access to affected devices when attackers change or delete accounts.
People
Ben BernsteinManager of the Cybersecurity Advisors Team at Huntress; commented on the campaign's tactics and ransomware access.Dray AghaSenior manager of Tactical Response at Huntress; recommended security measures for organizations.Ensar SekerSOCRadar CISO who commented on the campaign and its continued credential validation and access attempts.
Malware
INCit to downstream threat actors. This is evidenced by the fact that operator overlaps tying FortiBleed to INC and Lynx ransomware operations, likely indicating that the access is being abused for ransomware deployment.Lynxdownstream threat actors. This is evidenced by the fact that operator overlaps tying FortiBleed to INC and Lynx ransomware operations, likely indicating that the access is being abused for ransomware deployment.PAYLOADThe fact that initial-access brokers using the FortiBleed attack chain have also supplied access to Payload ransomware affiliates is evidence that the operation is financially motivated and part of a broader ransomware
Vendors
Products
Tools
FortigateSnifferon data obtained from prior leak dumps and infostealer logs, and then deploy a Go-based tool called FortigateSniffer to passively intercept authentication traffic across 24 protocols and harvest credentials andHashmatThe password hashes are then routed to a GPU-accelerated cracking cluster that uses Hashmat and Hashtopolis for offline cracking, after which they are used to facilitate lateral movement, Active Directory enumeration,HashtopolisThe password hashes are then routed to a GPU-accelerated cracking cluster that uses Hashmat and Hashtopolis for offline cracking, after which they are used to facilitate lateral movement, Active Directory enumeration,