THREATNOIR
Subscribe
Back to advisories

FBI Warns FortiBleed Campaign Still Active, Hits 86,000+ FortiGate Devices

FortiBleed campaign is actively targeting 86,000+ FortiGate devices worldwide using credential stuffing and password spraying with stolen credentials from previous leaks. Successful compromises result in account lockouts of legitimate admins and device reconfiguration, with confirmed links to INC Ransom, Lynx, and Payload ransomware gangs. Every compromised FortiGate is a potential pivot point for network-wide ransomware deployment.

CRITICALAdvisoryOct 10, 2026
Action required
Immediately audit all FortiGate administrative accounts for unauthorized modifications, policy changes, and account lockouts. Force password resets for all FortiGate admin accounts using complex passwords not found in breach databases. Enable MFA on all FortiGate management interfaces and monitor authentication logs for credential stuffing patterns.
Affected products
FortiGateFortinet
Linked articles
Source links