Ongoing FortiBleed Campaign Is Locking Organizations Out of FortiGate Firewalls

Oct 7, 2026 · Original article ↗

Summary

A joint FBI and U.S. Secret Service advisory details the ongoing FortiBleed campaign, which compromises exposed Fortinet gateways, creates admin accounts, and can lock out legitimate users. The article outlines indicators and response measures.

Key points

Attackers scan exposed FortiGate SSL VPNs and use credential stuffing, password spraying, and offline hash cracking to obtain access.
The campaign has compromised more than 86,644 devices across 194 countries, according to the article.
In some cases, attackers create admin accounts and change or delete legitimate account passwords, potentially locking organizations out of their firewalls.
Compromised access has been linked to INC/Lynx and Payload ransomware affiliates; access may be used later by other actors.
Investigate unexpected admin accounts, authentication anomalies, Active Directory enumeration, SSH access, and unknown FortiGate REST API keys; treat listed IPs as historical indicators.
Recommended measures include restricting external management, terminating sessions, resetting credentials, enforcing phishing-resistant MFA, reviewing logs, and validating configurations.
Confirm FortiOS admin credentials use PBKDF2 and purge weaker legacy hashes, following Fortinet guidance for FortiOS v7.2.11 and later.

Article Details

Defense Focus: Detect and contain FortiBleed access to internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, then recover compromised devices and prevent continued actor access.
Detection Methods: Hunt for unexpected administrative accounts, including the listed account-name indicators.
Review authentication telemetry for credential-stuffing, password-spraying, and successful authentication from listed source IPs.
Correlate listed C2, proxy, beacon-relay, and supporting infrastructure IPs with current telemetry; the article cautions that cloud addresses may be reassigned.
Review SSH access where firewall SSH was exposed, and enumerate REST API keys for unknown or rogue keys.
Inspect firewall, VPN, authentication, and domain-controller logs for unusual access, lateral movement, unauthorized configuration changes, and bursts of Active Directory enumeration.
Validate device configurations against a known-good baseline and check FortiOS admin credential storage for legacy hashes.
Data Sources: FortiGate firewall logs and configuration
SSL VPN and authentication logs
Domain-controller logs
SSH access records
FortiGate administrative account lists
FortiGate REST API key inventory
FortiOS credential-storage configuration
Rule Types: Authentication anomaly detections
New administrative account detections
Source-IP and infrastructure indicator matching
Active Directory enumeration burst detections
Unauthorized configuration-change detections
Platforms: Fortinet FortiGate firewalls
Fortinet SSL VPN gateways
FortiOS
Defensive Actions: Restrict external management to trusted hosts, enforce local-in policies, or remove internet-facing administration.
Terminate active administrative sessions and reset Fortinet VPN and administrative passwords on internet-facing systems.
Enforce strong password policies and phishing-resistant MFA for remote-access and administrative accounts and interfaces.
Confirm admin credentials use PBKDF2 and purge weaker legacy hashes, following Fortinet guidance for FortiOS v7.2.11+.
Remove unknown REST API keys and refresh legitimate keys; a rogue key may survive a password reset.
Ensure out-of-band administrative recovery is available for edge devices, especially if legitimate accounts have been altered or deleted.
Isolate compromised hosts, scope the intrusion before applying countermeasures, and then harden affected systems.
Treat confirmed FortiBleed exposure as a possible precursor to multiple ransomware outcomes; do not pay ransoms.

Indicators of compromise

Type	Indicator	Context
IPV4	`103[.]27[.]186[.]156`	Identified as a proxy node.
IPV4	`104[.]28[.]155[.]27`	Listed as a brute-force and successful-authentication source IP observed during June–July 2026.
IPV4	`154[.]202[.]59[.]169`	Identified as a proxy node.
IPV4	`185[.]136[.]15[.]43`	Listed as a brute-force and successful-authentication source IP observed during June–July 2026.
IPV4	`185[.]136[.]15[.]66`	Listed as a brute-force and successful-authentication source IP observed during June–July 2026.
IPV4	`185[.]199[.]199[.]56`	Listed as a brute-force and successful-authentication source IP observed during June–July 2026.
IPV4	`193[.]8[.]186[.]33`	Listed as a brute-force and successful-authentication source IP observed during June–July 2026.
IPV4	`193[.]8[.]187[.]2`	Identified as infrastructure facilitating the attack chain.
IPV4	`193[.]8[.]187[.]42`	Identified as infrastructure facilitating the attack chain.
IPV4	`45[.]154[.]12[.]132`	Identified as C2 infrastructure.
IPV4	`45[.]155[.]250[.]158`	Identified as a beacon relay.
IPV4	`45[.]227[.]254[.]210`	Listed as a brute-force and successful-authentication source IP observed during June–July 2026.
IPV4	`66[.]175[.]220[.]111`	Listed as a brute-force and successful-authentication source IP observed during June–July 2026.
IPV4	`77[.]91[.]118[.]10`	Listed as a brute-force and successful-authentication source IP observed during June–July 2026.
IPV4	`80[.]75[.]212[.]113`	Listed as a brute-force and successful-authentication source IP observed during June–July 2026.
IPV4	`85[.]11[.]187[.]8`	Identified as infrastructure facilitating the attack chain, including Hashtopolis.
IPV4	`87[.]251[.]64[.]13`	Listed as a brute-force and successful-authentication source IP observed during June–July 2026.
IPV4	`87[.]251[.]64[.]16`	Listed as a brute-force and successful-authentication source IP observed during June–July 2026.
IPV4	`87[.]251[.]64[.]17`	Listed as a brute-force and successful-authentication source IP observed during June–July 2026.
IPV4	`87[.]251[.]64[.]44`	Listed as a brute-force and successful-authentication source IP observed during June–July 2026.