FBI warns FortiBleed attacks still lock out FortiGate admins

· Cybersecurity · United States

The FBI and the U.S. Secret Service warned on Tuesday that the FortiBleed credential-harvesting campaign remains an active threat against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The campaign has amassed 86,644 Fortinet device credentials, according to the warning, and exploits reused or weak credentials to lock legitimate administrators out of their own devices. Organizations running exposed FortiGate appliances are urged to rotate credentials and restrict management access. The alert underscores how long-running credential theft campaigns keep paying off for attackers long after initial disclosure, and how reused passwords turn a single stolen secret into broad access.

Why it matters：It highlights that credential reuse and exposed remote-access gateways remain the most exploited entry point for enterprise breaches, keeping pressure on organizations to rotate secrets and harden VPN infrastructure.

Key points

  • FBI and Secret Service say the campaign has collected 86,644 Fortinet device credentials.
  • Targets are internet-facing FortiGate firewalls and SSL VPN gateways.
  • Attackers exploit reused credentials to lock out legitimate administrators.

Sources (original reporting)

More stories from this day