FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials

The FBI and U.S. Secret Service warn that the FortiBleed campaign is actively targeting internet-facing FortiGate firewalls and SSL VPNs by leveraging reused/leaked credentials, legacy SHA-256 password storage, and a Go-based FortigateSniffer tool to harvest credentials and password hashes at scale (reported ~86,644 working device credentials across 194 countries); attackers crack hashes with GPU-accelerated tooling, create persistence, perform lateral movement and data exfiltration, and package/sell access to downstream ransomware actors — agencies recommend enabling phishing-resistant authentication, terminating sessions, resetting passwords, using PBKDF2 for admin credential storage, reviewing logs, and reporting incidents to authorities.