FBI: FortiBleed attacks lock out FortiGate VPN admins

The FBI says FortiBleed attacks are ongoing against exposed Fortinet FortiGate firewalls and SSL VPN gateways, locking legitimate administrators out of their devices.

Attackers use previously leaked credentials or logins obtained through infostealer logs, credential stuffing and password spraying. They extract more authentication data from compromised devices, then use distributed GPU clusters running Hashcat and Hashtopolis to crack stolen password hashes offline.

The FBI has observed the attack chain as an initial entry point for ransomware affiliates. The source identifies INC/Lynx ransomware and Payload ransomware among groups benefiting from the activity.

FortiBleed is a Fortinet credential leak discovered in June, when a server exposed usernames and plaintext passwords associated with 73,932 firewall URLs in 194 countries. SOCRadar later linked the leak to INC and Lynx ransomware operations. Its latest count cited in the report was 86,644 compromised devices.

In some incidents, the threat actor creates administrator accounts, then deletes existing admin accounts or changes their passwords to deny victims access. The attacker also establishes persistence and attempts to move laterally. An accidentally exposed backend server revealed automated scanning, password-cracking and credential-validation tools, along with target lists and working VPN configurations.

The FBI says remediation may require more than patching and changing Fortinet passwords. It suggests restricting external access, ending active VPN sessions, enforcing MFA, reviewing logs for unauthorized changes and suspicious activity, and using PBKDF2 for administrator password storage. The agency says PBKDF2 is much stronger than legacy SHA-256 hashes that attackers can practically crack offline.