FortiBleed is still locking admins out of their own FortiGates — reset logins and lock down management today

Picture the call: the firewall is up, traffic is flowing, and nobody on your team can log in to it. Not because it crashed, but because someone else changed the admin password last night and deleted your account on the way out.

That is what the FBI and the U.S. Secret Service say is now happening to some FortiGate owners. FortiBleed, the credential campaign that surfaced in June, never stopped. It is still logging in to exposed FortiGate firewalls and SSL VPN gateways with real passwords, and some of that access is being sold to ransomware crews.

There is no firmware update for a stolen password. A fully patched FortiGate can still be someone else’s FortiGate.
The 5-Minute Cyber Brief
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Email address
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.

What happened

On Tuesday, October 6, 2026, the FBI and USSS published a joint cybersecurity advisory (JCSA-20261006-01), “FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts.” It describes FortiBleed as an active, global credential-compromise campaign against internet-facing FortiGate firewalls and SSL VPN gateways, and cites SOCRadar’s count of more than 86,644 compromised devices across 194 countries.

The attack chain, as the advisory lays it out: scan the internet for FortiGate SSL VPN portals; try credentials from earlier Fortinet leak dumps and infostealer logs through stuffing and spraying; pull FortiOS user databases and session tokens off any device that lets them in; crack the hashes offline on a rented GPU cluster running Hashcat and Hashtopolis; then create new admin accounts for persistence. In some cases the attackers delete or re-password the original admin accounts, which is where the lockouts come from. From the firewall they move inward with Active Directory enumeration and more password spraying.

The FBI says initial access brokers using this chain have handed access to affiliates of INC/Lynx and Payload ransomware. There is no new CVE in the advisory. The campaign runs on reused or leaked credentials and on legacy SHA-256 admin password storage that can be cracked at scale.

Why it matters

Most firewall emergencies end with “install the fixed build.” This one doesn’t. If an attacker has a working admin login, the newest firmware still lets them in. And the firewall is the one device you need to control during an incident. Getting locked out of it while someone moves toward your domain controllers is about the worst position you can be in.

The scale matters too. At tens of thousands of devices, this isn’t aimed at anyone in particular. The leaked tooling, per the advisory, filtered out honeypots and ranked victims by revenue and network structure. If your FortiGate faces the internet and its admin or VPN passwords have ever been reused, assume it is on someone’s list.

What to do first

Take admin access off the internet. The FBI ranks the options: trusted hosts (good), a local-in policy (better), no internet administration at all (best).
Terminate every active admin and VPN session, then reset all Fortinet VPN and administrator passwords, starting with internet-facing units.
Require phishing-resistant MFA on every remote-access and admin account, enforced at the gateway and the admin interface.
List every local admin and compare it with what you expect. Look hard at names like fortiAdmin, forticloud-sync, forticloud-tech, adminsslvpn, support_fortinet, forti_support2 and Technical_support. They’re from the FBI’s list of accounts found on victim devices.
Review REST API keys. Remove any you can’t explain and rotate the rest.
Move admin password storage to PBKDF2 and clear legacy hashes, following Fortinet’s guidance for FortiOS 7.2.11 and later.
Before you touch anything, confirm you have console or out-of-band access and a known-good config backup. If you get locked out mid-cleanup, that’s how you get back in.

Forward this

If we use Fortinet FortiGate firewalls or FortiGate VPN: the FBI and Secret Service warned on October 6 that attackers are logging in to exposed FortiGates with stolen passwords, creating their own admin accounts, and in some cases locking the real admins out. Some of these break-ins have led to ransomware. Updating the firmware won’t stop it. Please make sure whoever runs our firewall resets the admin and VPN passwords, turns on phishing-resistant MFA, and takes admin access off the internet this week. Then ask them to confirm every admin account on the device is one of ours.

Details

Advisory: FBI / USSS joint cybersecurity advisory JCSA-20261006-01, published October 6, 2026, TLP:CLEAR.
Targets: Internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. All 16 critical-infrastructure sectors are named as in scope.
Scale: More than 86,644 compromised devices across 194 countries (SOCRadar figure cited by the FBI). The campaign first surfaced in June, when the operators exposed a server holding usernames and plaintext passwords tied to 73,932 firewall URLs.
Method: Credential stuffing and password spraying from earlier leaks and infostealer logs. After that, theft of FortiOS user databases and session tokens, offline GPU cracking of legacy SHA-256 hashes, new admin accounts for persistence, and lateral movement into Active Directory.
Impact reported: Lockouts of legitimate admins (original accounts deleted or re-passworded). Access brokered to INC/Lynx and Payload ransomware affiliates.
CVE: None. This is a credential and configuration problem, not a new software flaw.
Fortinet position (June): Fortinet attributed the activity to reuse of previously stolen credentials and brute force against devices with weak password hygiene and no MFA.

Hunt / verify

Diff the running config against your last known-good backup. Focus on admin users, VPN users, local-in policies, trusted hosts and API keys.
Search firewall and VPN logs for the infrastructure the FBI named. That includes C2 45.154.12.132, proxy nodes 154.202.59.169 and 103.27.186.156, beacon relay 45.155.250.158, and 193.8.187.2, 193.8.187.42 and 85.11.187.8 (Hashtopolis). Beacons used ports 4332 and 4432 as well as HTTPS. The advisory’s Table 1 lists more IPs seen from June to July 2026. Treat them as historical and check them against current telemetry before you block.
Check SSH exposure on the firewall. The advisory notes attackers may have used SSH where the port was open.
On domain controllers, look for spraying or bulk enumeration from VPN-assigned address pools since June.
If you find an unknown admin account: preserve logs, isolate the device, and follow the incident-response steps in the advisory before you reset anything.

FortiBleed (FBI/USSS advisory, Oct 6): attackers are logging in to exposed FortiGates with stolen creds, adding admins, sometimes locking real admins out, and passing access to ransomware crews. No patch fixes this. Today: kill all admin + VPN sessions, reset passwords, phishing-resistant MFA, take admin off the internet, audit admin accounts and API keys, move to PBKDF2 hashes.

Sources

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].