FBI and Secret Service Detail FortiBleed Campaign Targeting Exposed Fortinet Gateways

Oct 6, 2026 · Original article ↗

Summary

An FBI and Secret Service advisory describes a global campaign using reused or leaked credentials to compromise exposed Fortinet gateways, with possible administrator lockouts and ransomware access. It recommends credential resets, MFA, and restricted management access.

Key points

The agencies describe FortiBleed as an active campaign targeting internet-facing FortiGate firewalls and SSL VPN gateways; SOCRadar reported more than 86,644 compromised devices across 194 countries.
Operators reportedly used credentials from prior leaks and infostealer logs, then harvested and cracked authentication data with a distributed GPU cluster.
The advisory says attackers created administrative accounts, enumerated Active Directory, and packaged access for sale as an initial-access brokerage operation.
Some organizations may be locked out if attackers delete accounts or change passwords; the campaign has also reportedly provided access to INC/Lynx and Payload ransomware affiliates.
The advisory includes observed IP addresses and compromised account names, and cautions that infrastructure indicators should be corroborated before blocking.
Recommended actions include restricting external management, ending active sessions, resetting Fortinet credentials, enabling phishing-resistant MFA, reviewing configurations and logs, and checking API keys.

Article Details

Attack Vectors: The FortiBleed campaign targets internet-facing FortiGate SSL VPN gateways and firewalls, scanning for exposed portals and using reused or leaked credentials in credential-stuffing and password-spraying attempts.
Operators harvest authentication data and FortiOS user databases or session tokens, then use a distributed GPU cluster with Hashcat and Hashtopolis to crack password hashes offline.
With validated credentials, operators create administrative accounts on FortiGate devices and enumerate Active Directory accounts; some incidents involve deleting or changing existing account credentials, potentially locking out legitimate administrators.
The advisory reports that initial-access brokers using this attack chain have provided access to ransomware affiliates, including INC/Lynx ransomware and Payload ransomware.
Defensive Notes: Restrict external device management through trusted hosts or local-in policies, or remove internet-facing administration.
Terminate active administrative sessions and reset Fortinet VPN and administrative passwords, especially on internet-facing systems; enforce strong password policies and phishing-resistant MFA.
Review firewall and VPN users and configurations for unauthorized changes, with particular attention to newly added or unrecognized accounts and unknown REST API keys; remove unknown keys and refresh legitimate keys.
Review firewall, VPN, authentication, and domain-controller logs for suspicious access, accounts, configuration changes, and lateral movement; investigate the listed IP indicators before blocking because infrastructure may be reassigned.
Confirm administrator credentials use PBKDF2 and remove weaker legacy hashes, following Fortinet guidance for FortiOS v7.2.11 and later.
If compromise is suspected, identify and isolate affected hosts, collect and review artifacts and logs for threat hunting, then apply eviction countermeasures and harden the network.

Indicators of compromise

Type	Indicator	Context
IPV4	`103[.]27[.]186[.]156`	Reported as a proxy node used by operators to obfuscate their presence.
IPV4	`104[.]28[.]155[.]27`	Listed as an IP address observed conducting brute-force attacks or successfully authenticating with compromised accounts.
IPV4	`154[.]202[.]59[.]169`	Reported as a proxy node used by operators to obfuscate their presence.
IPV4	`185[.]136[.]15[.]43`	Listed as an IP address observed conducting brute-force attacks or successfully authenticating with compromised accounts.
IPV4	`185[.]136[.]15[.]66`	Listed as an IP address observed conducting brute-force attacks or successfully authenticating with compromised accounts.
IPV4	`185[.]199[.]199[.]56`	Listed as an IP address observed conducting brute-force attacks or successfully authenticating with compromised accounts.
IPV4	`193[.]8[.]186[.]33`	Listed as an IP address observed conducting brute-force attacks or successfully authenticating with compromised accounts.
IPV4	`193[.]8[.]187[.]2`	Reported as facilitating the FortiBleed attack chain.
IPV4	`193[.]8[.]187[.]42`	Reported as facilitating the FortiBleed attack chain.
IPV4	`45[.]154[.]12[.]132`	Reported as a command-and-control server in the FortiBleed campaign.
IPV4	`45[.]155[.]250[.]158`	Reported as a beacon relay in the FortiBleed attack chain.
IPV4	`45[.]227[.]254[.]210`	Listed as an IP address observed conducting brute-force attacks or successfully authenticating with compromised accounts.
IPV4	`66[.]175[.]220[.]111`	Listed as an IP address observed conducting brute-force attacks or successfully authenticating with compromised accounts.
IPV4	`77[.]91[.]118[.]10`	Listed as an IP address observed conducting brute-force attacks or successfully authenticating with compromised accounts.
IPV4	`80[.]75[.]212[.]113`	Listed as an IP address observed conducting brute-force attacks or successfully authenticating with compromised accounts.
IPV4	`85[.]11[.]187[.]8`	Reported as facilitating the attack chain and used for the Hashtopolis tool.
IPV4	`87[.]251[.]64[.]13`	Listed as an IP address observed conducting brute-force attacks or successfully authenticating with compromised accounts.
IPV4	`87[.]251[.]64[.]16`	Listed as an IP address observed conducting brute-force attacks or successfully authenticating with compromised accounts.
IPV4	`87[.]251[.]64[.]17`	Listed as an IP address observed conducting brute-force attacks or successfully authenticating with compromised accounts.
IPV4	`87[.]251[.]64[.]44`	Listed as an IP address observed conducting brute-force attacks or successfully authenticating with compromised accounts.