FortiBleed Attackers Locking Victims Out of Fortinet Devices

The FortiBleed campaign targets internet-accessible Fortinet FortiGate firewalls and SSL VPN appliances by leveraging previously compromised credentials and brute-force attacks to gain unauthorized access. Once inside, attackers create new accounts and delete or change passwords of existing accounts to lock out legitimate users and maintain persistence. The campaign has compromised approximately 86,644 devices across 194 countries. Attackers scan for exposed SSL VPN portals, harvest credentials from infostealer logs and previous dumps, crack hashed credentials offline, and sell working VPN configurations and target lists. The FBI and US Secret Service jointly warn that victims may be locked out of their Fortinet devices due to account deletions or password changes by attackers. They recommend identifying compromised hosts, scoping intrusions, evicting attackers, and hardening defenses.

Attackers gain unauthorized access to Fortinet devices, lock out legitimate users by deleting or changing account credentials, and maintain persistence for potential lateral movement within victim environments. This disrupts normal device management and security operations, potentially exposing organizations to further compromise.

The FBI and US Secret Service recommend affected organizations identify compromised devices, scope the intrusion, and evict attackers. Organizations should restrict management access, reset all Fortinet VPN and administrative passwords, implement phishing-resistant multifactor authentication (MFA), review firewall and VPN user configurations, validate API keys, review logs for suspicious activity, and ensure secure credential storage. These steps help reduce the attack surface and prevent further unauthorized access.