What happened
The FBI and the US Secret Service issued a joint warning on Tuesday that the FortiBleed credential harvesting campaign remains an active threat against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. In the advisory, the agencies said the campaign "exploits reused or leaked credentials and legacy SHA-256 password storage, enabling threat actors to harvest and crack authentication data at scale," and that initial findings show attackers are continuing to scan exposed Fortinet firewalls using credentials they obtained earlier.
FortiBleed was first documented in June 2026 by SOCRadar and Hudson Rock. The Russian-speaking operation is estimated to have collected more than 86,644 working device credentials across 194 countries as of June 19. The campaign runs in five stages: reconnaissance of exposed portals, credential stuffing and password spraying using data from leak dumps and infostealer logs, deployment of a Go-based tool called FortigateSniffer that passively intercepts authentication traffic across 24 protocols, offline cracking on GPU clusters using Hashmat and Hashtopolis, and finally lateral movement, Active Directory enumeration and exfiltration. New administrative accounts are created on the appliance to keep access.
The agencies also warned that some victims may be locked out of their own devices because the attacker deleted or changed the original account password. CISA's earlier guidance asked Fortinet customers to enable phishing-resistant authentication, terminate active SSL VPN and administrative sessions, reset VPN and administrative passwords, store administrator credentials using PBKDF2, and review logs for suspicious activity. Investigators suspect the operator is an initial access broker selling access onward, with reporting tying the activity to INC and Lynx ransomware operations.
Why this is a GRC story
Credential reuse is the control that failed. The technology was not the weak point. Reused and leaked passwords were. That is a policy and monitoring problem, and it shows up in most environments that have never audited whether device administrative passwords are unique.
Legacy password storage turns one exposure into many. The advisory specifically names SHA-256 storage. Where credentials are stored that way, stolen hashes can be cracked offline at scale. Moving administrator credentials to PBKDF2 is a documented action item, not a research project, and it reduces the value of a stolen hash.
Recovery plans need to assume you lose admin access. Deleting accounts on the appliance is a simple way to hold a victim hostage. A response plan that assumes administrative access will still exist is incomplete. Break-glass access, offline configuration backups and a documented rebuild path belong in the runbook before an incident, not during one.
What to watch
Watch whether CISA ties FortiBleed to a binding operational directive or a known exploited catalogue entry. Either move attaches an agency remediation deadline and gives private sector teams a date they can take to their own leadership. Watch also for the first ransomware deployment publicly attributed to access sold out of this campaign, because that is when board-level attention usually arrives.
The practical work is unglamorous. Inventory every appliance reachable from the internet, confirm administrative credentials are unique and stored with PBKDF2, require phishing-resistant multi-factor authentication, and keep an out-of-band way to regain control of a device if an account disappears.
Attribution: Analysis based on The Hacker News and related public reporting. This article is original commentary, not a repost of the source material.