FortiBleed Is Still Active, Locking Organizations Out

FortiBleed is an active, large-scale credential compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways that has resulted in over 86,000 confirmed compromised devices; recent shifts include attacker-driven lockouts of legitimate administrators, widening downstream ransomware affiliates, and ongoing scanning and authentication using previously harvested credentials. The report provides the attack chain, high-signal IOCs (IPs, account names, ports), detection priorities (auth anomalies, new account creation, AD enumeration), and concrete mitigations including session termination, credential resets, API key audits, MFA enforcement, and FortiOS credential storage fixes.