FBI Issues Alert on Active FortiBleed Campaign Harvesting Credentials from Exposed FortiGate Firewalls

The FBI and the United States Secret Service have issued a joint alert about the ongoing FortiBleed campaign, which targets FortiGate firewalls and SSL VPN gateways exposed to the internet.

According to the agencies, the operation remains active and has already harvested 86,644 valid credentials from devices located in 194 countries as of June 19. The broad geographic spread indicates large-scale, untargeted scanning rather than focused espionage.

The attackers exploit reused or previously leaked credentials and take advantage of older SHA-256 password hashing stored on the devices, which significantly speeds up offline brute-force attempts outside the victim environment.

The campaign combines three primary techniques: automated testing of known credentials, the FortigateSniffer tool written in Go that intercepts authentication traffic across 24 different protocols, and GPU-accelerated password cracking.

After gaining access, the operators create unauthorized administrator accounts. In many cases they also delete the original legitimate accounts, leaving the rightful administrator locked out while the attacker retains persistent control. Recovery then requires full device restoration instead of a simple password change.

The activity was first observed in June, yet the official alert from U.S. authorities was published only on October 7. The agencies continue to warn that operators are still actively scanning the internet for exposed Fortinet devices.