86,644 Firewalls in 194 Countries Breached With Stolen Passwords

The FBI and U.S. Secret Service advisory details the global 'FortiBleed' credential-compromise campaign affecting internet-facing Fortinet FortiGate firewalls and SSL VPNs — reportedly over 86,644 devices across 194 countries — where attackers used credential stuffing, leaked Fortinet dumps and infostealer logs, and GPU-accelerated hash cracking (Hashcat/Hashtopolis) to obtain plaintext credentials, create administrative persistence, and sell access to downstream actors including ransomware affiliates; the advisory provides IOCs (multiple IPs and account names) and recommends mitigations such as terminating admin/VPN sessions, enforcing phishing-resistant MFA, migrating to PBKDF2 for admin hashes, reviewing API keys and logs, isolating compromised hosts, and reporting incidents to law enforcement.