FortiBleed campaign harvests login credentials from 86,000 Fortinet devices

FortiBleed, detected in 2026, is a credential-harvesting campaign aimed at internet-facing FortiGate firewalls and SSL VPN gateways, the doors organisations use for remote access. The Hacker News reported on 7 October that, as of 19 June, the attackers had amassed working credentials for 86,644 devices in 194 countries. BleepingComputer said the figure stood at 73,932 firewall addresses when the campaign was first spotted. The Record reports that at least 12 organisations have been breached and encrypted with ransomware.

The campaign relies not on a new software flaw but on old and leaked passwords. BleepingComputer says the attackers use leaked passwords and infostealer logs, combined with two techniques: credential stuffing, which replays passwords leaked from other sites, and password spraying, which tries common passwords across many accounts. Captured password hashes are cracked on distributed GPU clusters with two open-source tools, Hashcat and Hashtopolis. According to The Hacker News, part of the weakness lies in an outdated SHA-256 password-storage method, and the FBI recommends moving administrator passwords to PBKDF2.

BleepingComputer reported on 7 October that the attackers create new administrator accounts, delete existing ones and lock organisations out of their own devices. The Record notes that the warning follows a CISA alert in June 2026 and earlier advisories from British authorities. The attackers left their own back-end server exposed, according to The Record, and The Hacker News describes the operation that law enforcement observed there in five stages. On 7 October the FBI and the Secret Service urged organisations to review all Fortinet accounts, reset passwords and terminate open administrator VPN sessions.