FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins

The FBI has issued a warning about ongoing FortiBleed attacks targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways, where threat actors use leaked or stolen credentials to gain access and lock out legitimate administrators. Attackers extract authentication data and crack password hashes offline using distributed GPU clusters with tools like Hashcat and Hashtopolis. The compromised access is used as an initial entry point for ransomware affiliates, including INC/Lynx and Payload ransomware groups, who establish persistence, move laterally, and in some cases, sell access. The original FortiBleed leak exposed plaintext credentials for over 86,000 devices, and attackers have been observed creating new admin accounts, deleting existing ones, and preparing compromised access for sale.

AI-extracted · verify before operational use