FBI Warns Forti Bleed Remains Active After Amassing 86,644 Fortinet Device Credentials
Summary: The FBI and Secret Service warned on Tuesday that the FortiBleed credential harvesting campaign remains active against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, exploiting reused or leaked credentials and legacy SHA-256 password storage. The Russian-speaking operation is estimated to have netted more than 86,644 working device credentials across 194 countries as of June 19, 2026, using a five-stage chain that deploys a Go-based tool called FortigateSniffer to intercept authentication traffic across 24 protocols and routes hashes to a GPU-accelerated cracking cluster using Hashmat and Hashtopolis.
Why it matters: SOCRadar reports at least 12 ransomware deployments stemming from this access, with hundreds of endpoints encrypted, and warns that devices breached months ago remain in the actors' validated inventory - so credentials you consider stale may still be a live entry point. In some cases attackers deleted or changed passwords on the appliance itself, leaving organizations locked out of their own firewall and facing a physical factory reset before encryption begins.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026