FBI Warns FortiBleed Campaign Targeting Fortinet Firewalls and VPNs to Steal Credentials

The FBI and U.S. Secret Service warn of an active FortiBleed campaign compromising FortiGate firewalls and SSL VPNs via reused/leaked credentials and legacy hash weaknesses; attackers harvest and crack credentials at scale (reported 86,644 devices across 194 countries), create or modify admin accounts to maintain access, and broker access to ransomware affiliates. Agencies recommend restricting internet-facing management, terminating sessions, resetting credentials with strong storage (PBKDF2), enforcing phishing-resistant MFA, investigating unfamiliar accounts, and conducting coordinated eviction and threat hunting.