Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks

FortiBleed is an ongoing credential-compromise campaign exploiting Fortinet firewalls and VPN gateways that enables attackers to steal credentials, create administrative accounts, and lock legitimate users out; the FBI and Secret Service warn the intrusion has been used as initial access for ransomware affiliates. Security firm SOCRadar initially verified over 86,644 compromised devices and later identified a wider targeting of roughly 400,000–450,000 firewalls; agencies recommend removing internet-facing management, resetting credentials, enabling MFA, reviewing logs and users, and sharing IOCs such as IPs and usernames.