GoKawiilFBI Warns of Persistent FortiBleed Attacks Locking Out FortiGate Admins
The FBI has issued a warning that ongoing FortiBleed exploits continue to target exposed Fortinet FortiGate firewalls and SSL VPNs, often resulting in legitimate administrators being locked out. Attackers leverage leaked credentials, credential stuffing, and password spraying to access these systems, then use advanced GPU-based tools to crack password hashes offline. The campaign has been linked to ransomware groups such as INC/Lynx and Payload, with over 86,000 devices affected since the leak was first discovered in June.
GoKawiil's interpretation of the reporting above, not reported fact.
This ongoing threat highlights the persistent vulnerabilities in exposed network devices and the potential for attackers to use compromised credentials for ransomware deployment. It underscores the importance for organizations to secure their VPN endpoints and monitor for signs of lateral movement or account manipulation, as attackers can establish persistence and disrupt operations.
- FortiBleed continues to compromise thousands of devices globally.
- Attackers use leaked credentials and GPU cracking tools to gain access.
- Organizations should strengthen VPN security and monitor for account changes.
Source: bleepingcomputer.com, 2026-10-07
Published there as: “FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.