A joint FBI and U.S. Secret Service advisory says an ongoing FortiBleed credential-compromise operation is still targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The advisory warns that some affected organisations may lose access to their own devices if attackers change passwords or delete original administrator accounts after creating new ones for persistence. [1]
FortiBleed is being used here as the name of a credential-harvesting and access-broker operation, not as the name of a newly disclosed Fortinet vulnerability. Fortinet said in June that the activity involved reused credentials and brute-force attempts against devices with weak password hygiene or no multi-factor authentication, and said it was not related to a new Fortinet vulnerability or recent advisory. [3]
Key points
- The FBI and Secret Service published their joint advisory on October 6, 2026, describing continued scanning of exposed FortiGate systems. [1]
- The agencies say some victims may be locked out after attackers change passwords or delete existing accounts and create new ones. [1]
- CISA and Fortinet recommend terminating sessions, rotating credentials, enforcing phishing-resistant MFA and restricting public management access. [2] [3]
- Device-count estimates differ because they cover different datasets, dates and definitions; they should not be combined into one confirmed total. [1] [2] [6]
- The advisory says the access can serve as an entry point for ransomware affiliates, but it does not mean every exposed device suffered ransomware deployment. [1]
What happened
The October 6 advisory describes FortiBleed as an active global campaign against internet-facing FortiGate firewalls and SSL VPN gateways. It says attackers are continuing to scan exposed systems with credentials obtained earlier, then use credential stuffing, password spraying and password cracking to turn leaked authentication data into working access. The agencies say attackers can create new local administrator accounts and package access for other actors. [1]
The lockout claim is specific. Based on initial responses, the FBI and Secret Service say some victims may be unable to log in if an intruder changes the password for an original account or deletes it. New accounts may be created at the same time to preserve the intruder’s access and support movement inside the victim’s network. It is not a universal outcome. [1]
The advisory also identifies a ransomware connection. It says reporting indicates that initial-access brokers using the FortiBleed attack chain have supplied access to INC/Lynx and Payload ransomware affiliates. SOCRadar reports at least 12 related ransomware deployments. That is reporting about identified cases, not every device. [1] [6]
Why it matters
A compromised edge device can affect more than the firewall itself. FortiGate appliances and SSL VPN gateways sit at a boundary between the public internet and internal networks. If an attacker obtains working administrative or VPN credentials, the resulting access may permit configuration changes, additional account creation or attempts to move toward directory services and other internal systems. The agencies therefore describe risks beyond a password leak, including account-access removal and ransomware. [1]
The campaign shows why a software update alone may not answer the question. Fortinet says the activity is not a new vulnerability, and its guidance focuses on credential resets, MFA, configuration checks, logs and management-access restrictions. CISA similarly tells customers to terminate active SSL VPN and administrative sessions, reset credentials and check for suspicious changes. [2] [3]
Scale figures require care. CISA’s June alert referred to leaked credentials associated with approximately 74,000 Fortinet devices. The October advisory cites SOCRadar’s verification of more than 86,644 compromised devices across 194 countries. SOCRadar’s own later research describes more than 430,000 FortiGate firewalls targeted in the broader operation, while also reporting smaller, more specific sets of portals and confirmed access. These numbers describe different observations and definitions. They are evidence of a large campaign, not a single audited count of victims. [1] [2] [6]
What administrators should check
The response starts with containment and credential hygiene. Organisations that suspect exposure should review whether management interfaces are reachable from the public internet, restrict them to trusted networks where possible, terminate active administrative and VPN sessions and reset Fortinet administrator and VPN credentials. Phishing-resistant MFA should be enforced for remote-access and administrative accounts. [1] [2] [3]
Teams should compare the current firewall and VPN configuration with a known-good version and investigate unfamiliar local users, API keys, password changes or other modifications. The FBI and Secret Service also recommend reviewing firewall, VPN, authentication and domain-controller logs for unusual access, lateral movement and suspicious accounts. Their advisory includes observed indicators, but it cautions that infrastructure can be reassigned; indicators should be checked against current telemetry before blocking or acting on them. [1]
Credential storage is another part of the response. CISA and Fortinet point customers toward PBKDF2-based administrator credential storage and Fortinet’s related configuration guidance. Arctic Wolf’s background analysis explains why older credential material may remain relevant after an upgrade if administrator passwords have not been refreshed as required. That supports a full credential review, but not a claim about every FortiOS installation. [2] [3] [7]
If an organisation finds evidence of unauthorised changes or cannot access its device, incident responders should preserve logs and other artifacts before destructive remediation where feasible, isolate the affected system and follow an incident-response plan. The FBI and Secret Service advise collecting evidence and reporting suspected criminal activity through the channels described in their advisory. [1]
What remains uncertain
Public evidence does not provide a complete lockout count. The primary advisory says “some victims may” be locked out and bases that warning on initial responses. It does not identify every organisation affected or establish how frequently account deletion or password changes occurred. Independent coverage repeats the warning but cannot replace investigation. [1] [4] [5]
Impact also needs qualification. SOCRadar links the operation to ransomware infrastructure and reports confirmed deployments, while the government advisory says the chain has been observed as an initial entry point. Those findings justify urgent defensive work, but do not prove that every credential, firewall or lockout had the same outcome. [1] [6]
The different device figures should remain attributed to their original sources. Treating the largest number as a universal victim total would overstate the evidence. Fortinet’s position that FortiBleed is not a new vulnerability should also be preserved; the available sources do not support adding a CVE, severity score or patch deadline to this story. [1] [2] [3]
What happens next
Defenders should verify exposure rather than rely on the age of a leaked credential. Organisations should determine whether FortiGate or SSL VPN management was exposed, rotate relevant credentials, enforce MFA, inspect accounts and configurations, review logs and restrict management access. The FBI and Secret Service say indicators should be vetted against current telemetry; Fortinet said remediation and customer outreach were ongoing in June. [1] [3]
Further reporting may clarify the number of lockouts and ransomware cases. Until that evidence is available, the most accurate conclusion is narrower: the campaign remains active, government agencies have received reports of lockouts, and organisations with exposed Fortinet gateways should treat suspicious credentials or configuration changes as a possible compromise rather than as a routine password-reset event. [1] [4] [5]
