Reported by 12 outlets

Timeline

1. original reporting

   Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks

   cyberscoop.com · 7d ago · October 6th, 2026

   FortiBleed, a credential compromise campaign targeting Fortinet firewalls and VPN gateways, is an ongoing threat that can lock users out of their Fortinet accounts and also lead to ransomware attacks, the FBI and Secret Service said in an alert published Tuesday. “Affected organizations may find themselves locked out of their systems if threat actors disable accounts or change passwords, requiring remediation steps beyond standard patching and password resets,” the alert states . “In addition, the FortiBleed attack chain has been observed as an initial entry point for ransomware affiliates.” When it was first uncovered earlier this year, SOCRadar verified more than 86,644 compromised devices across 194 countries. Ensar Seker, chief information security officer of the company, told CyberScoop that “in our later investigation, we identified more than 400,000 or 450,000 firewalls targeted by the wider operation.” There are different aspects of the operation that make comparisons imprecise over time, but overall the numbers “show the campaign is broader and more serious than we understood at the beginning,” Seker said. The attackers can disable accounts or change passwords to lock users out with the access they gain, making standard password resets and patching insufficient, the government alert reads. The alert also warns that initial access brokers are making use of the FortiBleed attack to provide access to ransomware affiliates, including INC/Lynx and Payload. The government

2. update from nvd.nist.gov

   NVD record for CVE-2025-59718 (Fortinet FG-IR-25-647)

   nvd.nist.gov · 308d ago · December 9th, 2025

   Improper verification of cryptographic signature in FortiOS 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, 7.4.0 through 7.4.8, 7.6.0 through 7.6.3, FortiProxy 7.0.0 through 7.0.21, 7.2.0 through 7.2.14, 7.4.0 through 7.4.10, 7.6.0 through 7.6.3, and FortiSwitchManager allows an unauthenticated attacker to bypass FortiCloud SSO login authentication via a crafted SAML response. CVSS 9.8. The Fortinet advisory FG-IR-25-647 also covers twin CVE-2025-59719, which affects FortiWeb 7.4.0 through 7.4.9, 7.6.0 through 7.6.4, and 8.0.0.

3. update from arcticwolf.com

   Arctic Wolf observes malicious SSO logins on FortiGate devices following disclosure of CVE-2025-59718 and CVE-2025-59719

   arcticwolf.com · 302d ago · December 15th, 2025

   Arctic Wolf began observing intrusions involving malicious SSO logins on FortiGate appliances on December 12, 2025, three days after Fortinet's disclosure of the FortiCloud SSO signature verification bypass. This is early exploitation telemetry showing the FortiCloud SSO attack path was in use months before FortiBleed surfaced publicly in June 2026.

4. update from cisa.gov

   CISA adds CVE-2025-59718 to the Known Exploited Vulnerabilities catalog

   cisa.gov · 302d ago · December 16th, 2025

   CISA added CVE-2025-59718 to KEV on December 16, 2025, one week after publication, citing FortiOS, FortiSwitchManager, FortiProxy, and FortiWeb.

5. update from fortinet.com

   Fortinet PSIRT blog: Analysis of Single Sign-On Abuse on FortiOS

   fortinet.com · 264d ago · January 22nd, 2026

   Fortinet published vendor analysis of single sign-on abuse on FortiOS, proactively communicating to customers about the issue. The post appeared in January 2026, five months before the FortiBleed leak brought the credential campaign to public attention.

6. update from cisa.gov

   CISA adds CVE-2026-24858 to the Known Exploited Vulnerabilities catalog

   cisa.gov · 260d ago · January 27th, 2026

   CISA added CVE-2026-24858 to KEV on January 27, 2026, its publication date, for the FortiCloud SSO cross-account authentication bypass affecting FortiAnalyzer, FortiManager, FortiOS, and FortiProxy. Same-day KEV listing indicates confirmed exploitation from the start.

7. update from nvd.nist.gov

   NVD record for CVE-2026-24858 (Fortinet FG-IR-26-060)

   nvd.nist.gov · 259d ago · January 27th, 2026

   Authentication bypass using an alternate path in FortiAnalyzer 7.0.0 through 7.0.15, 7.2.0 through 7.2.11, 7.4.0 through 7.4.9, 7.6.0 through 7.6.5, FortiManager, FortiOS, and FortiProxy allows an attacker with a FortiCloud account and one registered device to log into devices registered to other accounts where FortiCloud SSO authentication is enabled. CVSS 9.8, advisory FG-IR-26-060.

8. update from hudsonrock.com

   FortiBleed — 73,000+ Fortinet VPN Credentials Exposed Across 194 Countries, Verified as Authentic

   hudsonrock.com · 118d ago · June 18th, 2026

   Security researcher Bob Diachenko discovered an exposed server containing what appears to be a database of Fortinet/FortiGate VPN credentials for 73,932 firewall URLs across 194 countries — approximately 50% of all internet-facing FortiGate devices globally. Hudson Rock independently confirmed the dataset covers 21,632 unique domains including Chevron, Samsung, Foxconn, Comcast, AT&T, Mercedes-Benz, Toyota, Siemens, Accenture, and government agencies. Kevin Beaumont independently verified multiple credentials as authentic and confirmed the data appears recent, distinct from the 2025 Belsen Group leak. The attackers — assessed as a Russian-speaking multi-operator group — allegedly conducted ~1.16 billion credential attempts against 320,777 FortiGate targets plus 2.1 billion against 163,650 Microsoft SQL Server systems, using a 45-GPU Hashtopolis cluster. They intercepted SSL VPN authentication hashes from exported Fortinet configs, cracked them, and used recovered credentials for lateral movement into Active Directory environments. Multiple orgs across Japan, Taiwan, Vietnam, Iraq, and Turkey were fully compromised, including a Turkish NATO defense contractor from which classified documents were allegedly stolen. Fortinet's statement characterizes the data as re-shared from previous incidents and brute-force campaigns, not linked to a new vulnerability. Hudson Rock has published a free domain lookup tool. Recommended actions: Immediately rotate VPN admin credentials, enforce MFA on all FortiGate admin accounts, review gateway logs for suspicious auth patterns, and do not expose the FortiGate management interface to the internet — a majority of affected devices had their management interface publicly accessible.

9. update from bleepingcomputer.com

   FortiBleed — CISA Formally Warns Fortinet Users After 74K Device Credentials Exposed, Most Devices Still Online

   bleepingcomputer.com · 117d ago · June 19th, 2026

   The agency called for terminating all SSL VPN and administrative sessions, resetting all passwords, enabling phishing-resistant MFA, and restricting management interfaces from public internet access. Context: Previously covered June 18 (initial disclosure, 73K+ credentials), June 16 (FortiSandbox exploitation). New today: CISA formal warning, confirmed authenticity by independent verification.

   ---

10. update from unit42.paloaltonetworks.com

    FortiBleed — Unit 42 Publishes Independent Analysis, Initial Access Broker Identified on Russian-Language Forum

    unit42.paloaltonetworks.com · 116d ago · June 20th, 2026

    Unit 42 published its own threat brief on the FortiBleed credential theft campaign, confirming the threat actors are using a curated password list built from prior breaches and successful vulnerability exploits for internet-wide password spraying against Fortinet, Sophos, and MSSQL services. An initial access broker (IAB) on the Russian-language Exploit[.]in forum has claimed responsibility, referencing an unspecified CVE and offering harvested credentials for sale as of June 16. Unit 42 has not validated the IAB's claims but observed the same campaign infrastructure targeting Palo Alto Networks customer telemetry as collateral. Recorded Future's Insikt Group independently identified malicious infrastructure (IP 85.11.187.8) linked to the campaign, recovering artifacts consistent with a full credential-harvesting and follow-on intrusion workflow: sniffer logs (fg_capture.log), Hashcat/Hashtopolis cracking orchestration files, Active Directory enumeration scripts (ad_enum.py, ad_full_audit.py), password-spraying tooling, SMB/DFS collection scripts, and log-clearing markers. New today: Unit 42 independent analysis, IAB attribution to Exploit[.]in forum, Insikt Group infrastructure artifacts.*

    Hunting hypothesis: Monitor for successful admin logins on FortiGate/Sophos edge devices within minutes of high-volume password-failure events — the IAB's workflow sprays first, then accesses immediately upon successful auth.

11. update from malware.news

    FortiBleed — Attackers Rented 36-GPU AI Cluster for $350/Day to Crack 75,000+ Fortinet Firewall Passwords at Nation-State Speed

    malware.news · 114d ago · June 22nd, 2026

    New analysis from InfoStealers reveals the operational mechanics behind the FortiBleed credential theft campaign with striking detail: the attackers bypassed Fortinet's encryption by renting a 36-GPU cluster on Vast.ai — a decentralized cloud compute marketplace built for the GenAI industry — at $14.40/hour (~$350/day) . The cluster, managed entirely through a Telegram bot, achieved:

    • 720 billion hashes/second against legacy Fortinet salted SHA-256 hashes

    • 180–360 million hashes/second against newer PBKDF2-based hashes (designed to resist GPU cracking)

    Beyond raw compute, the operators used AI-assisted coding tools (Cursor) to write the Telegram bots and management scripts, and agentic penetration testing frameworks to automate Active Directory enumeration after cracking credentials. This creates a fully AI-integrated intrusion pipeline: AI-written management code → rented AI GPUs → AI-driven post-exploitation. Initial access broker SantaAd was identified selling bulk Fortinet access on Russian-language forums, confirming the IAB-to-ransomware affiliate pipeline these credentials feed into. Kevin Beaumont's analysis highlights the dark irony: the GenAI industry's GPU infrastructure has commoditized nation-state cryptographic attack capability.

12. update from bleepingcomputer.com

    FortiBleed Campaign — Custom FortigateSniffer Harvests Auth Traffic From 430K+ Compromised Firewalls

    bleepingcomputer.com · 113d ago · June 23rd, 2026

    The tool abuses FortiOS's built-in diagnose sniffer packet command to monitor traffic for authentication protocols across 24 protocols including RADIUS, NTLM, Kerberos, LDAP, SMB, RDP, and database services. Captured PCAP data is processed through a "PCAP Deep Analysis Toolkit" that extracts cleartext credentials, password hashes, and Kerberos tickets, then generates Hashcat-ready files for offline cracking on a distributed GPU cluster.

13. mentioned by malware.news

    FortiBleed — Arctic Wolf Reverse-Engineers 'CyberStrike Harvester' Behind Global FortiGate Credential Factory

    malware.news · 112d ago · June 24th, 2026

14. update from bleepingcomputer.com

    FortiBleed Credential-Theft Campaign Linked to INC and Lynx Ransomware — Over 430,000 FortiGate Devices Targeted

    bleepingcomputer.com · 104d ago · July 2nd, 2026

    Researchers identified a Windows server within the FortiBleed infrastructure showing browser sessions actively accessing both ransomware groups' negotiation panels — direct evidence that the same individuals operated across the credential-theft and ransomware extortion platforms. The campaign was substantially larger than previously understood: approximately 430,000 FortiGate firewalls were targeted, custom "FortiGate Sniffer" tools were deployed on roughly 19,000 devices to intercept VPN credentials and authentication data directly from network traffic, and over 500 operational servers were identified. SOCRadar believes the attackers exploited a previously undisclosed Nextcloud zero-day to expand access after initial compromise. The investigation identified persistent backdoor accounts using the username "adminin" on compromised systems and assesses the operation consists of roughly 20 members with defined roles.

15. update from blog.qualys.com

    FortiBleed: Qualys Publishes Comprehensive FortiGate Credential Exposure Analysis

    blog.qualys.com · 97d ago · July 9th, 2026

    Qualys has published a detailed technical analysis of the "FortiBleed" campaign — large-scale credential exposure and abuse targeting internet-reachable FortiGate management and SSL-VPN gateways. The analysis maps eight relevant Fortinet CVEs (including CVE-2026-24858, CVE-2025-59718, and CVE-2025-59719) to Qualys QIDs and provides QQL queries for VMDR, ETM, and CSAM to identify and prioritize exposed assets. Key finding: a patched device can remain compromised if credentials or configuration material were stolen before remediation, particularly where PBKDF2 migration and legacy-hash cleanup are incomplete. The post provides detection and threat-hunting guidance across four areas: authentication anomalies, configuration and account changes, downstream identity activity, and exposure and integrity validation. Recommended action: Treat Qualys QID matches as investigation seeds, not confirmed compromise.

16. update from malware.news

    FortiBleed Is Still Active, Locking Organizations Out

    malware.news · 6d ago · October 7th, 2026

    If you defend or triage Fortinet exposure, this is the document to read in full; it adds field-response detail that changes how you should scope, hunt and remediate. Below is what is operationally relevant right now: what has changed since the earlier reporting, the indicators to hunt on today, and the actions that actually close the gap. SOCRadar’s Threat Research Unit first documented FortiBleed in June , and we have folded the relevant background in where it helps you act. This is the headline shift in impact. Alongside creating new admin accounts for persistence ( T1136.001 ), the actors in some cases delete or change the passwords of legitimate original accounts ( T1531 , Account Access Removal). Defenders can find themselves shut out of their own FortiGate devices while the actor retains control and pivots internally. Rec

17. update from gbhackers.com

    FBI Warns FortiBleed Campaign Targeting Fortinet Firewalls and VPNs to Steal Credentials

    gbhackers.com · 6d ago · October 7th, 2026

    Secret Service issued a joint cybersecurity advisory warning that operators of “FortiBleed” continue to target internet-facing Fortinet FortiGate firewalls and SSL VPN gateways to steal credentials, maintain unauthorized access, and potentially facilitate ransomware attacks. Published on October 6, 2026, the advisory emphasizes administrator lockouts as an emerging consequence of this campaign.

18. update from bleepingcomputer.com

    FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins

    bleepingcomputer.com · 6d ago · October 7th, 2026

    By the SOCRadar's latest count, the FotiBleed compromised 86,644 devices .

19. mentioned by www.bleepingcomputer.com

    🤖 FBI: FortiBleed attacks still ongoing vs exposed Fortinet FortiGate firewalls/SSL VPNs. Leaked/infostealer creds reused, hashes cracked of

    www.bleepingcomputer.com · 6d ago · October 7th, 2026

20. mentioned by www.bleepingcomputer.com

    🤖 FBI: FortiBleed attacks on exposed FortiGate firewalls & SSL VPN gateways are still ongoing. Attackers use leaked/infostealer credentials,

    www.bleepingcomputer.com · 5d ago · October 8th, 2026

21. mentioned by threatnoir.com

    ⚠️ CRITICAL: FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials FortiBleed campaign continues harvesting

    threatnoir.com · 5d ago · October 8th, 2026

22. mentioned by www.bleepingcomputer.com

    FBI: Ongoing # FortiBleed attacks lock out # FortiGate # VPN admins https://www. bleepingcomputer.com/news/secu rity/fbi-ongoing-fortibleed-

    www.bleepingcomputer.com · 5d ago · October 8th, 2026