Overview
- The FBI and U.S. Secret Service warned Tuesday that FortiBleed is still active and that attackers continue to scan internet-facing FortiGate firewalls and SSL VPN gateways using previously leaked credentials.
- Operators harvest authentication traffic with a tool called FortigateSniffer, collect password hashes, and use GPU-accelerated cracking to recover passwords because many devices still store admin passwords with legacy SHA-256 hashing.
- Attackers commonly create new administrative accounts and in some cases delete or change existing accounts, which can lock legitimate administrators out and make recovery require device isolation, artifact collection, and deeper remediation than simple patching or resets.
- Investigators verified at least 86,644 compromised Fortinet devices spanning roughly 194 countries, while SOCRadar later suggested the wider operation may have targeted many more firewalls; stolen access has been observed funneled to initial access brokers and ransomware affiliates such as INC/Lynx and Payload.
- Agencies and vendors advise removing internet administration where possible, terminating active sessions, enforcing phishing-resistant MFA, migrating admin credential storage to PBKDF2, reviewing logs for lateral movement, and reporting incidents to law enforcement.