Vulnerabilities · Threat Intelligence · Application Security
FortiBleed Attack Locks Organisations Out of Fortinet Firewalls Worldwide
Criminals using stolen credentials are locking IT teams out of Fortinet firewalls, with over 86,000 devices affected globally. The FBI and Secret Service urge urgent action to prevent further lockouts and ransomware attacks.
Ross GrantUpdated 3 min read
The short version
Criminals are breaking into Fortinet firewalls and VPNs by using stolen passwords from old data leaks. Once inside, they lock out the real IT staff and sometimes sell access to ransomware gangs. Over 86,000 devices have been hit worldwide. If your organisation uses Fortinet equipment, urgent checks and password changes are needed.
By the numbers
- 86,644Fortinet devices compromised worldwideThe Hacker News
- 194Countries with affected devicesThe Hacker News
- 12Confirmed ransomware attacks linked to FortiBleedThe Register
What happened?
Criminals running the FortiBleed campaign have compromised over 86,000 Fortinet firewalls and VPN devices worldwide using stolen credentials. The FBI and Secret Service warn that attackers are locking out legitimate administrators, creating new accounts, and selling access to ransomware groups. The campaign is ongoing, with organisations urged to take urgent action.
Attackers Lock Out IT Teams Using Stolen Credentials
A global cybercrime campaign known as FortiBleed is targeting organisations that use Fortinet FortiGate firewalls and VPN gateways. According to a joint advisory from the FBI and US Secret Service, attackers have used stolen credentials to compromise at least 86,644 devices in 194 countries. In many cases, IT administrators are being locked out of their own network equipment, making recovery much harder and opening the door to further attacks, including ransomware FBI IC3 (opens in a new tab) The Register (opens in a new tab).
How the FortiBleed Attack Works
FortiBleed does not rely on a new software flaw. Instead, it exploits weak security practices. Attackers gather usernames and passwords from previous data leaks and from malware that steals credentials from infected computers. They then use automated tools to try these credentials on internet-facing Fortinet devices, a technique called credential stuffing. If the credentials work, they gain access and extract password hashes (scrambled versions of passwords) from the device. These hashes are cracked offline using powerful computers, allowing attackers to access more accounts The Hacker News (opens in a new tab) Security Affairs (opens in a new tab).
Once inside, the attackers create new administrator accounts to maintain access. In some cases, they delete or change the passwords of existing accounts, locking out legitimate IT staff. This not only blocks defenders from fixing the problem but also helps attackers stay hidden and move deeper into the network.
Ransomware Risk and Criminal Marketplace
The FBI and Secret Service warn that FortiBleed is not just about stealing credentials. The attackers are acting as initial access brokers, criminals who sell access to compromised systems. Ransomware groups, including those linked to the INC/Lynx and Payload operations, have used FortiBleed access to launch attacks that encrypt data and demand payment. At least 12 ransomware incidents have been traced back to FortiBleed-compromised devices The Register (opens in a new tab) The Hacker News (opens in a new tab).
What Fortinet and Authorities Recommend
The FBI, Secret Service, and security researchers urge all organisations using Fortinet devices to take immediate action:
- Remove internet-facing management interfaces where possible.
- Terminate all active administrative and VPN sessions.
- Reset all passwords for admin and VPN accounts.
- Enable phishing-resistant multi-factor authentication (MFA).
- Check for new or suspicious accounts on devices.
- Review logs for signs of compromise and lateral movement.
- Upgrade to FortiOS 7.2.11 or later, which uses stronger password hashing (PBKDF2) instead of legacy SHA-256.
They also warn that simply patching or changing passwords may not be enough if attackers have already created persistent accounts. Full audits and ongoing monitoring are needed.
What Happens Next and What You Should Do
The campaign is ongoing, and attackers continue to scan for exposed devices. Organisations that have not yet checked their Fortinet equipment should do so urgently. Reporting incidents to authorities can help track the threat and prevent further damage. The FBI and Secret Service also warn against paying ransoms, as this does not guarantee recovery and may encourage further attacks.
If your organisation uses Fortinet firewalls or VPNs, assume exposure if you have not followed the latest security advice. Restrict access, rotate credentials, and enable strong authentication to reduce the risk of lockout and ransomware.
Claimed vs confirmed
- Confirmed
FortiBleed attackers have compromised over 86,000 Fortinet devices.
FBI and Secret Service advisory, supported by SOCRadar's verification.
- Confirmed
Attackers are locking out legitimate admins by deleting or changing account passwords.
Stated in FBI and Secret Service advisory and reported by multiple outlets.
- Confirmed
Ransomware groups are using FortiBleed access to launch attacks.
SOCRadar and FBI link FortiBleed access to ransomware groups INC/Lynx and Payload.
The impact
- Money
- Organisations could face costs from downtime, recovery, and possible ransomware payments. Under GDPR, fines can reach up to £17.5m or 4% of global turnover for serious breaches.
- Reputation
- Being locked out of security devices and hit by ransomware can damage trust with customers and partners, especially if operations are disrupted.
- Customers
- Customers may experience service outages or data risks if their provider is affected. Organisations should notify affected users and follow incident response best practices.
Why it matters
This attack affects thousands of organisations globally, including businesses, schools, and hospitals that rely on Fortinet firewalls for security. Being locked out of critical network equipment can halt operations and make it easier for ransomware attacks to succeed. The campaign shows the risks of weak password practices and the importance of strong authentication.
How does it work?
Attackers use credential stuffing (trying stolen usernames and passwords) to access internet-facing Fortinet devices. Once in, they extract password hashes, crack them offline, create new admin accounts, and sometimes delete or change existing accounts to lock out IT staff. This allows persistent access and enables further attacks, including ransomware.
Key points
- FortiBleed has compromised over 86,000 Fortinet devices worldwide.
- Attackers use stolen credentials, not a software flaw, to gain access.
- IT admins are being locked out by attackers creating or deleting accounts.
- Access is sold to ransomware groups, leading to further attacks.
- Authorities urge urgent password resets, MFA, and removal of internet-facing admin access.
Sources
FBI IC3
Government
The Register
Reference
The Hacker News
Reference
Security Affairs
Reference
BleepingComputer
Reference
SecurityWeek
Reference
Infosecurity Magazine
Reference
- FBI and Secret Service Warn of FortiBleed Lockout Threat (opens in a new tab)
infosecurity-magazine.com
- FBI and Secret Service Warn of FortiBleed Lockout Threat (opens in a new tab)
