The FBI and U.S. Secret Service issued a joint warning on Tuesday that the FortiBleed credential harvesting campaign is still running against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The agencies say attackers continue to scan exposed Fortinet appliances using credentials they already stole. Original reporting for this article comes from The Hacker News.
The Russian-speaking operation has collected more than 86,644 working device credentials across 194 countries as of June 19, 2026.
SOCRadar and Hudson Rock first documented the campaign in June 2026. The operators work by exploiting reused or leaked passwords combined with legacy SHA-256 password storage on Fortinet devices, a hashing method old enough that stolen hashes can be cracked offline at scale.
If your firewall or VPN gateway is the thing attackers get into, the usual internal defenses matter less. These are edge devices, meaning they sit at the boundary between your network and the internet and decide who gets in. A valid admin credential on that device looks like normal administrative work, not an intrusion, so perimeter logging and login alerts often record it as routine.
Anyone running an internet-exposed FortiGate appliance falls inside the affected population, and organizations whose devices were reachable during the exposure window are the most likely to have had credentials captured. The important detail for executives is that applying firmware updates does not undo this. The attackers hold working usernames and passwords that keep working after a patch, which is why credential rotation, and not patching alone, is the deciding factor in whether access is actually closed.
The agencies assess the group to be an initial access broker, packaging verified access and selling it onward. Operator overlaps link FortiBleed to the INC and Lynx ransomware operations, so the practical downstream outcome for many victims is ransomware deployment rather than quiet espionage.
How FortiBleed Harvests and Cracks Fortinet Credentials
FortiBleed runs as a five-stage operation, and the first stage is reconnaissance against internet-exposed Fortinet portals rather than exploitation of a named vulnerability. The source does not attribute initial access to any CVE. Entry comes from credential stuffing and password spraying using material pulled from prior leak dumps and infostealer logs (MITRE T1110.004 and T1110.003), which means an appliance running current firmware is still reachable if a VPN user's password turned up in a commodity stealer log.
Once the operators authenticate, they deploy FortigateSniffer, a Go-based tool that sits on the device and passively intercepts authentication traffic across 24 protocols. Passive interception (T1040, network sniffing) produces no failed logins and no exploitation artifacts, so the collection phase looks like normal device operation. The tool harvests both cleartext credentials and password hashes as users and services authenticate through the firewall.
That placement matters because a FortiGate sits in the authentication path for more than VPN users. Traffic traversing the appliance exposes the credential material your directory services, management accounts, and site-to-site tunnels depend on, which is why a single compromised edge device turns into an identity problem across the network.
Harvested hashes move offline to a GPU-accelerated cracking cluster built on Hashmat and Hashtopolis, the latter being a job distribution framework that splits cracking work across multiple GPU nodes (T1110.002). Offline cracking happens on the attacker's infrastructure, so lockout thresholds and rate limits on your side never fire. The recovered plaintext stays valid until the account password actually changes, independent of firmware level.
The output is then processed rather than used raw. Per the agencies, cracked credentials were enriched, sorted, and validated, with scripts filtering out honeypots, mapping organizations, and prioritizing high-value targets based on revenue and network structure. That triage step is consistent with an access brokerage model, where the product sold downstream is a validated, attributed credential set with a profile attached.
Post-authentication activity follows a conventional path: lateral movement, Active Directory enumeration, Kerberos validation, and SMB authentication (T1087, T1021.002). Stolen session cookies are reused to maintain authenticated access without re-entering credentials (T1550.004), and sensitive data from network shares is exfiltrated in the final stage.
Persistence on the appliance itself comes from account creation (T1136). The FBI and USSS list account names observed on compromised devices, which are usable as hunting artifacts:
adminin,fortiAdmin,forticloud-sync,admin,fgtsecure,pakedgeforticloud-tech,districtadmin,system_config,gttadmin,roadmin,itadminTechnical_support,adminsslvpn,IT_Manager,my_admin,support_fortinet,fgtsec,forti_support2
Several of these imitate legitimate Fortinet service and support naming, which is the point. An entry like forticloud-sync reads as vendor plumbing in an admin list.
The agencies also report that operators delete or change passwords on original accounts. Some victims have been locked out of their own firewalls while the intruders continued moving laterally, which turns an identity compromise into a loss of control over the device that enforces your perimeter policy.
Attribution downstream is stated with qualification in the source. The operator is suspected to be an initial access broker, and overlaps with INC and Lynx ransomware operations are described as likely evidence that the access feeds ransomware deployment rather than confirmed joint operation. The source identifies no command-and-control domains, IP addresses, or file hashes for FortigateSniffer.
From Stolen Credentials to INC Ransom and Lynx Deployments
The FBI and Secret Service assess that the operator behind FortiBleed functions as an initial access broker, packaging validated firewall credentials and selling them on. Investigators found operator overlaps tying the campaign to INC Ransom and Lynx ransomware activity, which indicates the access is being resold for encryption attacks. The group that steals your VPN login is not necessarily the group that encrypts your file servers weeks later.
Before a sale happens, the stolen material gets quality-checked. The agencies describe cracked credentials being enriched, sorted, and validated, with scripts filtering out honeypots, mapping organizations, and prioritizing high-value targets based on revenue and network structure. If your company shows healthy financials and a flat internal network, your credential set is worth more to a ransomware affiliate than a small firm's.
The hands-on-keyboard progression after that purchase follows a familiar shape. The operators use verified credentials to move deeper into the environment, run enumeration, and conduct additional password spraying internally to locate privileged accounts. From the firewall, that path runs through Active Directory enumeration, Kerberos validation, and SMB authentication into the file shares where your contracts, HR records, and client data sit. Sensitive data from those network shares is exfiltrated, and stolen session cookies keep the attacker authenticated without needing to log in again.
Persistence is handled directly on the appliance. Attackers create new administrative accounts that were never on the device before, using names designed to blend into a firewall admin list: forticloud-sync, fgtsecure, adminsslvpn, support_fortinet, IT_Manager, districtadmin, and similar. Some of these read like accounts your own MSP or integrator would have created, which is exactly the point.
The more disruptive variant is account deletion. The FBI and USSS warn that some victims may be locked out of their Fortinet devices entirely when the threat actor deletes or changes the password on original accounts. Losing administrative control of the firewall means you cannot pull configuration, review rules, or cut VPN access from the console while the intruder is still working inside your network.
For your business, the costs stack in three places. Operational downtime comes first, since encryption of file servers and the loss of firewall administration stop normal work until systems are rebuilt. Double extortion follows, because the data was taken from your shares before anything was encrypted, so paying to decrypt does not remove the leak-site listing. Third, VPN accounts usually map to named employees, and the records pulled from internal shares frequently include customer and staff identity data, which puts you into breach notification territory with regulators and clients regardless of whether you restore from backup.
Cyber insurance adds another consideration. Carriers routinely ask whether privileged access was protected by multifactor authentication and whether administrative sessions were reset after a known campaign disclosure, and answers to those questions shape coverage discussions after a claim.
The point worth carrying to your leadership team is this: no CVE drove the initial access here. Your FortiGate can be fully patched and still have a working attacker account on it from an earlier login, because the exposure was credentials, not firmware. Patch level tells you nothing about whether someone already holds valid access to your gateway.
Credential Rotation and Compromise Assessment for FortiGate Deployments
Start with credential rotation, and scope it to everything the firewall can see rather than just the admin login you use daily. Every secret stored in or reachable from an affected FortiGate configuration should be treated as known to the operators:
- Local administrator and read-only admin accounts
- SSL-VPN user passwords, including service and contractor accounts
- LDAP and RADIUS bind accounts used for directory authentication
- IPsec pre-shared keys on every site-to-site tunnel
- SNMP community strings and REST API keys or tokens
Rotating only the admin password leaves the bind account and the pre-shared keys intact, and those give an attacker a path back into your directory and your branch tunnels without touching the firewall login again.
Next, audit your administrator and VPN account lists against the names the FBI and Secret Service published. The operators create accounts that read like legitimate infrastructure: forticloud-sync, fgtsecure, adminsslvpn, system_config, support_fortinet, forti_support2, itadmin, districtadmin, and my_admin, among others. An account called forticloud-tech does not look out of place in a change log, which is the point.
Check for deletions as well as additions. The agencies note that existing accounts have been removed or had passwords changed, which can leave an organization locked out of its own appliance. Confirm you have working console or out-of-band access before you begin changing credentials, so a rotation does not strand you.
Then diff the running configuration against your last known-good backup. Look for added SSL-VPN portals and realms, new or widened firewall policies, changes to admin trusted-host restrictions, modified log forwarding destinations, and altered VPN split-tunnel settings. Terminate all active SSL-VPN and administrative sessions once rotation is complete, since valid session cookies survive a password change. Move administrator credential storage to PBKDF2 rather than the legacy hashing format, and enable phishing-resistant authentication on administrative access.
Over the following weeks, hunt backwards through your VPN authentication logs to the start of the exposure window. You are looking for successful logins from ASNs and countries your workforce does not use, repeated authentication from one source against many usernames, and accounts that authenticate at the VPN and then immediately enumerate Active Directory or run SMB authentication sweeps. In environments Capstone manages, Adlumin ITDR correlates VPN logins against directory activity and flags that sequence, where one credential arrives from an unfamiliar network and then starts querying domain objects.
Enforce MFA on every VPN account with no exemptions for service or vendor logins, because those are the accounts most likely to carry a password that has already surfaced in a stealer log. Watch for credential dumping and lateral movement attempts that precede an encryption event, which is how resold access typically shows up before ransomware is staged.
Longer term, take administrative interfaces off the public internet and restrict management to an internal jump host or a dedicated out-of-band path. Write credential rotation into your edge-device patching procedure so that every firmware upgrade is followed by a password and key change, not just a reboot. Verify firmware currency across the whole estate against the builds listed in Fortinet's current advisories, including appliances at remote sites that fall outside your main patch cycle.
If you find evidence of compromise, isolate the device, preserve configuration backups and logs before rebuilding, and report the incident to the FBI and Secret Service.
What Organizations Running Fortinet Appliances Should Do Next
The useful mental model here is that a firewall credential has a shelf life independent of your firmware version. If a password, pre-shared key, or bind account existed on an internet-facing FortiGate while the campaign was running, treat it as already in someone else's hands. Updating the appliance closes the door going forward, and it does nothing to the material that left the building earlier.
That distinction matters because the FBI and Secret Service describe the operation as ongoing, with operators still scanning exposed Fortinet appliances using credentials they collected previously. Your exposure is not tied to whether you were running a vulnerable build on a particular date. It is tied to whether any of your VPN or administrative secrets ever appeared in a leak dump or stealer log while the portal was reachable.
One practical consequence worth planning for: the agencies note that some victims lose access to their own devices. Operators have changed passwords on original accounts and, in certain cases, deleted existing accounts outright, which keeps the organization out while the intruder works deeper into the network. If you find yourself unable to authenticate to a FortiGate you administered last week, that is a finding, not an IT glitch.
If you suspect your devices are affected, the FBI and USSS have asked that incidents be reported to them directly, alongside the artifacts and logs collected from the appliance. Reporting gives the agencies visibility into which account names and access patterns are still in circulation, and it gives you a documented timeline for your own investigation.
