FortiBleed keeps scanning exposed Fortinet firewalls as toll grows to 400,000-450,000 devices

The FBI and U.S. Secret Service warned on Tuesday that the FortiBleed credential-harvesting campaign remains an active threat aimed at internet-facing Fortinet FortiGate firewalls and SSL VPN gateways.

"The campaign exploits reused or leaked credentials and legacy SHA-256 password storage, enabling threat actors to harvest and crack authentication data at scale," the agencies said.

"Initial findings indicate attackers are continuing to scan internet-exposed Fortinet firewalls using previously obtained compromised credentials," the agencies said.

The password hashes are routed to a GPU-accelerated cracking cluster using Hashmat and Hashtopolis for offline cracking, after which the credentials facilitate lateral movement, Active Directory enumeration, Kerberos validation and SMB authentication.

In the final stage, sensitive data from network shares is exfiltrated while stolen session cookies are used to maintain persistent, authenticated access.

"Cracked credentials were enriched, sorted, and validated, with scripts filtering out honeypots, mapping organizations, and prioritizing high-value targets based on revenue and network structure," the agencies said.

The adversary is suspected to be an initial access broker that packages the stolen information and sells it to downstream threat actors, with operator overlaps tying FortiBleed to the INC and Lynx ransomware operations.

During the initial intrusion, threat actors create new accounts not previously on the device and in some cases delete existing accounts to block organizations from accessing affected devices and to maintain persistence.

"Affected organizations may find themselves locked out of their systems if threat actors disable accounts or change passwords, requiring remediation steps beyond standard patching and password resets," the alert states.

SOCRadar verified more than 86,644 compromised devices across 194 countries when the campaign was first uncovered.

If potential compromise is detected, organizations are advised to isolate the affected devices, collect necessary artifacts and logs, report the incident to the FBI and USSS, and apply relevant countermeasures.

The alert warns that initial access brokers are using the FortiBleed attack to provide access to ransomware affiliates, including INC/Lynx and Payload.

The FBI and Secret Service recommend that Fortinet customers restrict external management or remove internet administration entirely, reset credentials, set up multifactor authentication, review firewall and VPN users for unauthorized changes, review logs, and enable secure credential storage.

The agencies are seeking information and indicators of compromise organizations can share, including IP addresses and the usernames the attackers use.

Commonly identified compromised or created account names include adminin, fortiAdmin, forticloud-sync, admin, fgtsecure, support_fortinet and IT_Manager.

"In our later investigation, we identified more than 400,000 or 450,000 firewalls targeted by the wider operation," SOCRadar CISO Ensar Seker told CyberScoop.

The numbers, Seker said, "show the campaign is broader and more serious than we understood at the beginning."

CISA urged FortiGate customers to enable phishing-resistant authentication, terminate active SSL VPN and administrative sessions, reset Fortinet VPN and administrative passwords, use the PBKDF2 algorithm to store administrator credentials, and review logs for suspicious activity.

The 86,644 devices SOCRadar first verified represent roughly one in five (about 19 to 22 percent) of the 400,000 to 450,000 firewalls Seker says the wider operation targeted.