Skip to main content
Explore our brands An Informa TechTarget Publication

People also ask

  • Loading questions...
site logo

FBI warns that FortiBleed credential-harvesting attacks are locking out firewall users

An initial access broker is working with various ransomware groups in a global campaign.

Published Oct. 7, 2026
David Jones's headshot
Reporter
Fortinet office in Nepean, Canada.
The Fortinet Technologies Canada office on Oct. 15, 2023, in Nepean, Ontario. Threat actors have been reusing credentials from prior incidents in a campaign targeting FortiGate firewalls through brute force techniques. iStock Editorial / Getty Images Plus via Getty Images

The FBI and U.S. Secret Service warned Tuesday that a monthslong credential harvesting campaign, dubbed FortiBleed, has escalated to the point where Fortinet FortiGate customers are being locked out of their devices. 

Threat actors are using stolen credentials to break into internet-facing FortiGate firewalls and secure socket layer virtual private network gateways across the globe. More than 86,000 devices have been compromised in 194 countries, according to estimates from SOCRadar. 

Authorities warned the main attackers are leveraging compromised FortiGate environments as an initial access point for ransomware. SOCRadar previously linked the FortiBleed campaign to INC and Lynx ransomware operations, and the FBI advisory also links the campaign to Payload ransomware.

“The evidence therefore goes beyond stolen information,” Ensar Seker, CISO at SOCRadar, told Cybersecurity Dive. “Attackers are monetizing working network access.”

Fortinet, in a June advisory