FortiBleed Credential Campaign: FBI Confirms 86,644 Fortinet Devices Compromised

FortiBleed is a multi-stage credential harvesting pipeline that begins with automated reconnaissance and ends with cracked, usable administrator credentials sold to ransomware affiliates.

Stage 1 is scanning and initial access. Operators run automated scanners that identify internet-facing Fortinet FortiGate management interfaces and SSL VPN portals by querying common ports and inspecting FortiOS-specific HTTP response headers. Against identified targets, they execute credential stuffing using previously leaked FortiGate credential dumps and infostealer logs, and password spraying using default and common Fortinet credentials. Fortinet devices without phishing-resistant MFA and without account lockout policies are vulnerable to both techniques.

Stage 2 is credential extraction. After gaining access to a device, attackers extract the FortiOS user database, which contains administrator account names, hashed passwords, and VPN user credentials. The password hashes use SHA-256 on devices that have not completed PBKDF2 migration. A custom Golang-based tool described in the FBI advisory as the FortiGate sniffer intercepts authentication traffic on compromised devices, capturing credentials in transit from legitimate users connecting to the VPN gateway. These captured credentials are fed back into the campaign's scanner to identify and compromise additional devices.

Stage 3 is offline cracking. Exfiltrated SHA-256 hashes are fed into a distributed cracking pipeline running Hashcat as the cracking engine and Hashtopolis as the task distribution system, deployed on rented commercial GPU infrastructure. SHA-256 hashes lacking sufficient salting crack in hours to days depending on password complexity and length.

Stage 4 is persistence and monetization. Operators create rogue administrative accounts using convincing service-account-style names to maintain persistent access. In confirmed incidents, legitimate administrator accounts are also deleted to lock out the original owner. Cracked and working credentials are then sold to ransomware affiliates and initial access brokers on underground markets.

The FortiBleed dataset has grown continuously since first disclosed in June 2026. SOCRadar's analysis underlying the FBI advisory documents more than 86,644 verified administrator credentials for internet-facing Fortinet FortiGate devices across 194 countries. The full scan footprint covers approximately 430,000 internet-facing Fortinet appliances; the 86,644 compromise figure reflects devices with confirmed working credentials in the dataset as of the advisory date.

The geographic distribution confirms the campaign's opportunistic, global scope: no single region represents the majority of compromised devices. Critical infrastructure sectors including finance, healthcare, and energy appear in the victim list alongside government agencies and manufacturing organizations. The FBI attributes the broad targeting to the campaign's automated, non-selective scanning approach, which indiscriminately hits every reachable FortiGate portal regardless of owner identity.

Ransomware linkage is confirmed. The FBI advisory names the Payload, INC, and Lynx ransomware operations as beneficiaries of FortiBleed credentials. At least 12 ransomware intrusions have been attributed to access obtained through the FortiBleed dataset. The typical path from credential sale to ransomware deployment covers days to a few weeks, giving defenders a narrow window between compromise and encryption if the device appears in the dataset.

The June 2026 initial public disclosure by researcher Volodymyr Diachenko identified an exposed attacker backend directory containing what appeared to be working FortiGate credentials. Since that disclosure, the dataset has continued to grow as the FortiGate sniffer harvests additional credentials from compromised devices acting as interception listening posts against connecting VPN users.

The FBI advisory attributes the FortiBleed operation to a financially motivated threat cluster with Russian-speaking indicators. Security researcher Volodymyr Diachenko, who first disclosed the exposed attacker backend on June 13, 2026, assessed the operation as run by a Russian-speaking multi-operator group based on language artifacts in the exposed infrastructure and tool code.

The campaign shows characteristics consistent with a professional initial-access broker or credential-harvesting service rather than a ransomware group operating its own attacks. The operators run highly automated infrastructure, sell access to multiple downstream customers, and appear focused on maximizing the volume of compromised credentials rather than directly conducting network intrusions. The FBI advisory links the credentials to affiliates of three distinct ransomware operations: Payload, INC, and Lynx. This is consistent with an access-broker model where credentials are sold or rented to multiple buyers simultaneously.

The custom Golang-based FortiGate sniffer tool indicates sophisticated development resources. Building a dedicated network tool for intercepting FortiOS authentication traffic requires detailed knowledge of FortiOS protocols and session handling, a level of investment beyond typical opportunistic credential campaigns. The Hashtopolis-based distributed cracking infrastructure reinforces this assessment.

The campaign has operated continuously since at least February 2026, nearly eight months before the FBI advisory. Multiple security vendors reporting different device counts reflect different measurement dates rather than conflicting data; the dataset has grown as the campaign compounds: compromised devices become interception nodes that harvest credentials from new connecting users, feeding those credentials back into the scanner to compromise additional targets.

The FBI advisory in JCSA-20261006-01 provides specific indicators for detecting FortiBleed compromise. The primary indicator class is rogue administrative accounts created by operators to maintain persistent access after the initial credential stuffing intrusion.

Known rogue account names documented in the advisory include: adminin, fortiAdmin, forticloud-sync, support_fortinet, system_config, forti_support2, itadmin, forticloud-tech, and fgtsecure. These names are designed to blend with legitimate service account naming conventions. Run get system admin on your FortiGate console and compare every account against your known administrator inventory. Any account you did not provision is attacker-created persistence.

Behavioral indicators include: administrator logins from unexpected source IP addresses or geographies; admin activity during off-hours inconsistent with normal maintenance windows; SSL VPN authentication failures in high volume from single or rotating source IPs; configuration changes not matching a recorded change window; and FortiGate configuration files accessed or exported outside of standard backup procedures.

Network indicators include outbound connections on TCP ports 4332 and 4432, which secondary sources link to the campaign's C2 beaconing behavior. Compromised FortiGate devices also act as passive listening posts that capture credentials from legitimate VPN users connecting to the device. If your FortiGate appears in the FortiBleed dataset, treat every credential used to connect to that VPN as compromised regardless of whether attackers created a rogue account on your specific device.

Full details on the original June 2026 FortiBleed dataset including the Hudson Rock exposure lookup tool are in the FortiBleed IOC dataset guide.

These rules detect rogue admin account creation on FortiGate devices and SSL VPN brute-force spraying patterns from FortiOS syslog data. Both carry experimental status; validate against your environment's log format before enabling automatic blocking.

The FBI advisory's recommended response actions address both the active compromise vector and the underlying credential hygiene gap that enables offline hash cracking. All steps below must be completed on every internet-facing FortiGate appliance.

FortiBleed illustrates a category of attack that no software patch resolves: the systematic exploitation of credential hygiene gaps at scale. The campaign has operated for more than eight months, growing its dataset from an initial public disclosure of approximately 73,000 credentials in June 2026 to the FBI-confirmed count of 86,644 compromised devices. Every week the campaign runs without remediation, new FortiGate devices enter the dataset.

For organizations running internet-facing FortiGate appliances, the question is not whether FortiBleed has targeted your devices but whether your credentials appear in the dataset. Hudson Rock and other vendors published exposure lookup tools based on the initial June 2026 dataset. The FBI advisory confirms the dataset has continued to grow since then, so a clean result in the June lookup does not guarantee the same status today.

The ransomware connection elevates this from a credential hygiene problem to a network continuity risk. Payload, INC, and Lynx affiliates have converted FortiBleed credentials into confirmed ransomware deployments. The pattern is consistent with how initial access brokers operate: credentials are sold to multiple buyers, increasing the chance that at least one buyer converts the access to a destructive intrusion before the victim detects the compromise.

Defenders managing environments that include FortiGate appliances should treat this advisory as a mandatory audit trigger, not an optional hardening recommendation. The Gentlemen ransomware campaign analysis from September 2026 documents how ransomware affiliates convert perimeter appliance credentials to domain-wide encryption in under 24 hours, illustrating the speed at which a FortiBleed credential becomes a ransomware incident.