FortiBleed Is Still Running: FBI Flags 86,644 Stolen Fortinet Credentials and Counting
The FBI and Secret Service have issued a joint warning that FortiBleed, the large-scale Fortinet credential harvesting operation first flagged in June 2026, is still active. Attackers are continuing to scan exposed FortiGate firewalls using previously stolen credentials, and show no signs of wrapping up.
The numbers are not small. The campaign, attributed to a Russian-speaking threat group, has accumulated over 86,644 working device credentials from Fortinet firewalls across 194 countries. The operation targets internet-facing FortiGate appliances and SSL VPN gateways, exploiting a combination of reused passwords, leaked credential dumps, and the fact that Fortinet historically stored passwords using SHA-256, a hashing algorithm that GPU-accelerated cracking clusters chew through at considerable speed.
FortiBleed runs as a five-stage operation. First, attackers scan the internet to identify exposed Fortinet portals. Then they attempt credential stuffing and password spraying using data harvested from infostealer logs and prior breach dumps. Once inside, they deploy a custom Go-based tool called FortigateSniffer, which passively intercepts authentication traffic across 24 different protocols, quietly hoovering up credentials and password hashes without triggering obvious alarms.
Those hashes are shipped off to a GPU cracking cluster running Hashcat and Hashtopolis for offline cracking. Once cracked, the credentials are used to move laterally through victim networks, enumerate Active Directory, validate Kerberos tickets, and authenticate over SMB. The final stage involves exfiltrating data from network shares while stolen session cookies maintain persistent authenticated access long after the initial breach.
The agencies note that compromised credentials were sorted, enriched, and filtered, with scripts designed to weed out honeypots and prioritise targets based on revenue and network complexity. New administrative accounts are created on compromised firewalls to maintain persistence, and in some cases existing accounts are deleted entirely, locking out the legitimate owners.
A selection of the commonly spotted rogue account names reads like a greatest hits of plausible-looking admin usernames: adminin, fortiAdmin, forticloud-sync, fgtsecure, Technical_support, IT_Manager, support_fortinet. Generic enough to blend in, specific enough to look intentional.
The threat group is assessed to be operating as an initial access broker, packaging stolen credentials and flogging them to other criminal outfits. Operator overlaps link FortiBleed activity to both the INC and Lynx ransomware groups, suggesting the harvested access is being converted into ransomware deployments downstream.
CISA has already urged FortiGate customers to enable phishing-resistant multi-factor authentication, terminate active VPN and admin sessions, reset all relevant passwords, switch to PBKDF2 for storing administrator credentials, and review logs for anything suspicious.
If you suspect compromise, the FBI and USSS recommend isolating affected devices immediately, preserving logs and forensic artefacts, and reporting to the relevant agencies. Applying available mitigations promptly is also advised, particularly given that threat actors are actively deleting existing accounts to complicate recovery efforts.