Federal authorities have issued an alert regarding persistent FortiBleed operations that continue to compromise Fortinet FortiGate firewalls and SSL VPN infrastructure, resulting in legitimate administrators being shut out of their own systems.
Threat actors gain initial access to exposed systems through multiple vectors: previously disclosed credentials, data harvested by infostealer malware, credential stuffing campaigns, and password spraying techniques. Once inside, they pilfer additional authentication credentials and deploy distributed GPU clusters running Hashcat and Hashtopolis to perform offline cracking of stolen password hashes.
The FBI stated that "the FortiBleed attack chain has been observed as an initial entry point for ransomware affiliates." Operators of INC/Lynx and Payload ransomware have both capitalized on this attack vector.
The leak that keeps on giving
FortiBleed originated from a significant Fortinet credentials leak uncovered in June, stemming from an inadvertently exposed server housing usernames and plaintext passwords tied to 73,932 firewall URLs spanning 194 countries. The disclosure pointed to a sophisticated credential-harvesting operation, though the specific methodology for obtaining the configuration data remained unclear at the time.
During July, security firm SOCRadar connected FortiBleed to INC and Lynx ransomware operations after gaining access to both groups' negotiation panels hosted on a server involved in the campaign. According to SOCRadar's most recent assessment, the FortiBleed incident has compromised 86,644 devices.
In certain cases, the attacker establishes new administrator accounts and leverages those privileges to remove existing admin accounts or modify their credentials, effectively preventing victims from accessing their own infrastructure. Following this lockout, the attacker maintains persistence and attempts to spread through the network.
The operation's details surfaced when the attacker unintentionally left their backend server accessible, exposing a directory containing operational tools and datasets. The exposed materials documented automated scanning scripts targeting FortiGate SSL VPN portals, a distributed GPU-based password-cracking infrastructure, and utilities designed to validate credentials, filter honeypots, identify target organizations, and rank them by revenue and network topology.
The exposed backend also contained functional VPN configurations and targeting lists, suggesting the operator was preparing compromised access for commercial resale.
The FBI emphasized that remediation extends beyond applying patches and resetting Fortinet credentials. Recommended actions include limiting external access, terminating all active VPN sessions, deploying multi-factor authentication, and auditing logs for unauthorized modifications and anomalous behavior.
Authorities also advise implementing PBKDF2 for administrator password storage, a substantially more robust approach than the legacy SHA-256 hashing that attackers can efficiently crack in offline scenarios.