Actor Profile

FortiBleed refers to a large-scale credential-harvesting and access-brokering campaign discovered in June 2026, when attackers inadvertently exposed a server containing usernames and plaintext passwords for 73,932 Fortinet FortiGate firewall URLs across 194 countries. The operation involves automated credential theft, offline password cracking using distributed GPU clusters (Hashcat/Hashtopolis), and packaging compromised VPN access for sale. The campaign has been linked to ransomware affiliate operations, serving as initial access for INC/Lynx and Payload ransomware groups. The attacker's exposed backend revealed sophisticated tooling for scanning exposed FortiGate SSL VPN portals, validating credentials, filtering honeypots, and prioritizing targets by revenue and network structure. By July 2026, SOCRadar reported 86,644 compromised devices.

TTPs (Tactics, Techniques, Procedures)

Initial access is achieved through previously leaked credentials, infostealer logs, credential stuffing, and password spraying attacks against exposed Fortinet FortiGate SSL VPN endpoints. Attackers extract additional authentication data from compromised devices and use distributed GPU clusters running Hashcat and Hashtopolis to crack stolen password hashes offline (legacy SHA-256 hashes). Post-compromise, threat actors create new administrator accounts, delete or change passwords for existing admin accounts to lock out legitimate administrators, establish persistence mechanisms, and attempt lateral movement within victim environments. The campaign employs automated scanning scripts to identify exposed FortiGate portals, credential validation tools, honeypot detection, and target prioritization based on organizational revenue and network architecture. Compromised access is packaged for sale to ransomware affiliates.

Targets & Patterns

The FortiBleed campaign targets organizations with exposed Fortinet FortiGate firewalls and SSL VPN gateways, with a focus on critical infrastructure and enterprise sectors in the United States and globally (194 countries affected). The attacker's tooling reveals deliberate target prioritization based on organizational revenue and network structure, suggesting a focus on high-value entities. The campaign serves as an initial access vector for ransomware operations, with confirmed links to INC/Lynx and Payload ransomware groups. The scale of compromise (86,644+ devices) indicates indiscriminate scanning combined with selective exploitation of high-value targets. Organizations using legacy SHA-256 password hashing rather than PBKDF2 are particularly vulnerable to offline credential cracking.

Historical Context

FortiBleed was first discovered in June 2026 when attackers accidentally exposed a backend server containing credentials for 73,932 firewall URLs. In July 2026, SOCRadar linked the campaign to INC and Lynx ransomware operations after gaining access to both groups' negotiation panels on a server used in the campaign. By SOCRadar's latest count, the campaign had compromised 86,644 devices. The FBI issued warnings in October 2026 confirming ongoing attacks and the campaign's role as an initial entry point for ransomware affiliates, including INC/Lynx and Payload ransomware groups. The accidental exposure of the attacker's backend infrastructure revealed the operational methodology, including automated tooling, distributed GPU password-cracking infrastructure, and access-brokering activities.

Defensive Recommendations

  • Immediately restrict external access to FortiGate SSL VPN portals and terminate all active VPN sessions to evict potential attackers
  • Enforce multi-factor authentication (MFA) on all FortiGate administrator and VPN accounts to prevent credential-based access
  • Migrate from legacy SHA-256 password hashing to PBKDF2 for administrator password storage to resist offline cracking attacks
  • Review FortiGate logs for unauthorized administrator account creation, password changes, account deletions, and suspicious VPN session activity
  • Reset all Fortinet credentials and conduct thorough hunting for persistence mechanisms, lateral movement artifacts, and unauthorized configuration changes
  • Monitor for credential stuffing and password spraying attempts against VPN endpoints using rate-limiting and anomaly detection
  • Validate that FortiGate devices are not using credentials from known breach datasets or infostealer logs

---

# Geopolitical Context

Geopolitical Context

The FortiBleed campaign represents a persistent, industrialized credential-harvesting operation that has compromised over 86,000 Fortinet devices globally since June 2026. The exposure of a backend server revealed sophisticated infrastructure—including distributed GPU clusters for offline password cracking and automated scripts for target prioritization by revenue and network structure—suggesting a well-resourced operation oriented toward access brokering. The FBI's public warning underscores U.S. government concern that this campaign serves as an initial access vector for ransomware affiliates, including INC/Lynx and Payload groups, which have targeted critical infrastructure. The scale (73,932 firewall URLs across 194 countries) and the operational security failure that exposed the attacker's tooling indicate a campaign that balances technical sophistication with organizational risk. The advisory reflects broader U.S. efforts to disrupt the ransomware ecosystem by addressing initial access brokers and credential-based intrusions.

State Actor Alignment

The FBI advisory does not attribute FortiBleed to a specific state actor. The campaign's characteristics—credential harvesting at scale, access brokering, and support for ransomware operations—are consistent with financially motivated cybercrime rather than state-sponsored espionage. However, the infrastructure's sophistication and the targeting of critical infrastructure across nearly 200 countries may warrant further scrutiny for potential nexus to jurisdictions that tolerate or benefit from ransomware ecosystems. The U.S. government's public warning and technical guidance signal a policy priority to mitigate ransomware enablers, aligning with ongoing sanctions and enforcement actions against ransomware operators and their facilitators. No direct state sponsorship or safe-haven jurisdiction is identified in available reporting.

Business Impacty pro region

FortiBleed's global footprint—affecting devices in 194 countries—poses significant risk to European critical infrastructure and enterprise networks reliant on Fortinet VPN solutions. European organizations face exposure to ransomware groups that have demonstrated willingness to target healthcare, energy, and government sectors. The campaign's use of infostealer logs and credential stuffing suggests overlap with broader cybercrime supply chains that affect transatlantic digital infrastructure. For NATO allies and EU member states, the advisory reinforces the need for coordinated vulnerability disclosure, mandatory multi-factor authentication (MFA) policies, and information-sharing on initial access tactics. In the Indo-Pacific and other regions, the targeting logic—prioritization by revenue and network structure—indicates that economically significant entities and supply chain nodes are at elevated risk. The FBI's recommendation to enforce PBKDF2 password hashing highlights a technical gap that may be exploited across multiple vendor ecosystems, not only Fortinet.

Forecast

If FortiBleed operators continue to monetize compromised access through ransomware affiliates, incident volumes involving INC/Lynx and Payload groups are likely to remain elevated in the near term, particularly against organizations that have not enforced MFA or rotated credentials since June 2026. If law enforcement or private-sector disruption efforts target the exposed backend infrastructure or arrest key operators, the campaign's operational tempo may decline, though successor operations leveraging similar techniques are probable given the profitability of access brokering. If Fortinet and peer vendors accelerate adoption of stronger password hashing (e.g., PBKDF2) and organizations implement the FBI's remediation guidance—including external access restrictions and session termination—the attack surface for credential-based intrusions may contract over the next six to twelve months. However, if legacy SHA-256 hashing and weak credential hygiene persist, FortiBleed-style campaigns are likely to expand to additional vendor platforms, sustaining the initial access market that underpins ransomware operations.