The U.S. Federal Bureau of Investigation (FBI) and Secret Service (USSS) have issued a joint warning stating that the FortiBleed credential harvesting campaign remains an active threat targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. According to the agencies, threat actors continue to leverage leaked credentials and legacy SHA-256 password storage to scan and compromise exposed security appliances at scale.
Five-Stage Credential Harvesting Model
First documented in June 2026 by SOCRadar and Hudson Rock, the Russian-speaking operation accumulated more than 86,644 valid device credentials across 194 countries by mid-June 2026. The campaign uses a five-stage intrusion process, beginning with widespread scanning to locate exposed portals. Attackers perform credential stuffing and password spraying using data compiled from prior breach leaks and infostealer logs.
Once initial access is established, the operators deploy a custom Go-based utility named FortigateSniffer to passively intercept authentication traffic across 24 separate network protocols, harvesting additional usernames and password hashes.
Offline Cracking and Deep Network Intrusion
Intercepted hashes are forwarded to GPU-accelerated cracking clusters running Hashmat and Hashtopolis. Automated scripts subsequently filter out honeypots and rank target organizations according to revenue and infrastructure structure. Once verified, these credentials allow attackers to conduct Active Directory enumeration, Kerberos validation, SMB authentication, and sensitive file exfiltration from network shares.
Account Spoofing and Ransomware Connections
To maintain long-term access, the threat actors create unauthorized administrative accounts on the compromised firewalls, using names such as adminin, fortiAdmin, fgtsecure, and forticloud-sync. Federal authorities noted that attackers frequently alter or remove legitimate administrative accounts, leaving organizations locked out of their own hardware. Security intelligence suggests the operation functions as an initial access broker, with observed overlaps linking stolen access to ransomware groups such as INC and Lynx.
Mitigation and Security Guidance
The Cybersecurity and Infrastructure Security Agency (CISA) and federal partners advise administrators of FortiGate appliances to adopt PBKDF2 hashing for credential storage and mandate phishing-resistant authentication. Organizations should terminate active SSL VPN and management sessions, reset administrative passwords, and audit accounts for unauthorized additions. If an intrusion is detected, affected devices must be isolated while forensic logs are gathered for law enforcement investigation.
AI-generated editorial illustration; not a documentary photograph.
Source: FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials
SIGNAL TITANS
Leave a Reply