FBI Warns FortiBleed Campaign Still Active, Hits 86,000+ FortiGate Devices

FortiBleed is an ongoing, large-scale campaign targeting internet-facing Fortinet FortiGate devices by leveraging stolen credentials, credential stuffing/password spraying and offline GPU hash-cracking to gain administrative access; over 86,644 devices across 194 countries are reported compromised and access has been linked to ransomware groups (e.g., INC Ransom, Lynx, Payload). The advisory and reporting include observed TTPs (automated target selection, account creation/deletion, exposed SSH/API misuse), example suspicious admin account names, and recommended mitigations such as terminating sessions, resetting credentials, restricting management access, and moving away from legacy SHA-256 password storage.