FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts

FortiBleed is an active global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. It leverages reused or leaked credentials and legacy SHA-256 password storage weaknesses to harvest and crack authentication data using distributed GPU clusters. Attackers scan for exposed FortiGate SSL VPN portals, collect credentials via stuffing and password spraying, and crack stolen password hashes offline. After gaining access, they create new administrative accounts for persistence and conduct Active Directory enumeration to escalate and expand access. The campaign has compromised over 86,644 devices across 194 countries and causes lockouts by deleting or modifying existing accounts. It functions as an initial-access broker with observed connections to INC/Lynx and Payload ransomware affiliates, posing a significant threat to affected organizations.

The campaign compromises Fortinet FortiGate firewalls and SSL VPN gateways by harvesting and cracking credentials, leading to unauthorized administrative access. This access allows attackers to create persistent accounts and perform Active Directory enumeration, potentially expanding their foothold within networks. Affected organizations may suffer account lockouts due to attacker modifications or deletions of legitimate accounts. The operation serves as an initial-access broker facilitating ransomware attacks by affiliates such as INC/Lynx and Payload, increasing the risk of subsequent ransomware incidents.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should immediately review exposed FortiGate SSL VPN portals and audit for unauthorized administrative accounts. Implement strong credential hygiene, including avoiding credential reuse and enforcing multi-factor authentication where possible. Monitor for unusual account activity and lockouts. Given the campaign's use of leaked credentials and password spraying, organizations should consider resetting credentials and enhancing password policies. Since this is an active campaign, timely detection and response are critical.