FortiBleed: Over 86,000 Fortinet FortiGate Firewalls Hijacked as FBI Warns Attacks Are Ongoing

On October 6, the FBI and the U.S. Secret Service issued a joint warning about the FortiBleed campaign. Attackers have taken over more than 86,000 Fortinet FortiGate firewalls and VPN gateways in 194 countries. SOCRadar verified 86,644 devices. The attacks are still ongoing, and access to the hijacked devices is ending up with ransomware groups.

Stolen Passwords, Not a New Vulnerability

FortiBleed doesn’t exploit a new vulnerability. Fortinet stresses that the campaign relies on reused and stolen credentials and on password guessing. According to the advisory, the attackers:

1. scan the internet for FortiGate SSL VPN portals,
2. try usernames and passwords from earlier data breaches and from the logs of password-stealing malware (infostealers),
3. use password spraying, which means trying common passwords against many accounts at once,
4. pull password hashes from the devices and crack them offline with GPUs, outside the victim’s network. Hashes stored with the older SHA-256 method are especially easy to crack. Older FortiOS versions used SHA-256 instead of the stronger PBKDF2,
5. sort the access they gain by the size of the victim company, which tells them how much it will sell for.

The campaign came to light after the attackers left their own back-end server exposed to the internet, which revealed their entire workflow.

What Happens After They Get In

Once logged in, the attackers create their own administrator accounts on the firewall and map the Active Directory domain. They keep that access even after the firmware is updated. Some victims were locked out of their own devices because the attackers deleted the legitimate administrator accounts or changed their passwords.

The FBI says FortiBleed serves as an entry point for affiliates of the INC/Lynx and Payload ransomware groups. SOCRadar has confirmed at least 12 ransomware attacks that started this way, with hundreds of computers encrypted.

What to Do If You Run FortiGate

Updating the firmware is not enough on its own. An attacker who has a valid password and their own account will still be inside. Recommended steps:

1. Review every account on the device, including administrators and VPN users, and delete any you don’t recognize.
2. Change all passwords for the device and the VPN, plus the passwords of domain accounts used to sign in through the VPN.
3. End all active admin and VPN sessions.
4. Turn off device management from the internet, or limit it to specific IP addresses.
5. Enable phishing-resistant multi-factor authentication (hardware security keys, FIDO2) for VPN and admin access.
6. Check that the device stores passwords with PBKDF2 and not the legacy SHA-256 method.
7. Review your logs from the past several months for sign-ins from unusual countries, new accounts and configuration changes. If you find anything, treat it as a breach of your whole network, not just the firewall.

SecurHUB’s Take

This is the second serious problem with Fortinet devices this month, after the zero-day vulnerability in FortiMail. But FortiBleed is a reminder that the weakest point is often the password, not the software. Your firewall and VPN are the front door to your company. Letting people sign in without a second factor, using passwords they also use elsewhere, is an open invitation. We review firewall and VPN configurations as part of our audits and penetration tests, and our SOC detects suspicious sign-ins in real time.

Sources: The Record, eSecurity Planet, Infosecurity Magazine, Check Point Research