FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials
- ID
- 32709
- Status
- summarized
- Published
- 07 Oct 2026, 7:56 PM
- Fetched
- 07 Oct 2026, 8:35 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/10/fbi-warns-fortibleed-remains-active.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.5
- Created
- 07 Oct 2026, 8:36 PM
- Tags
- Audience
- developersstartup_founders
What happened
The FBI and U.S. Secret Service issued a joint warning on Tuesday, October 7, 2026 that the FortiBleed campaign is still active against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The Russian-speaking operation is estimated to have collected more than 86,644 working device credentials across 194 countries as of June 19, 2026, using credential stuffing and password spraying against reused or leaked credentials and Fortinet's legacy SHA-256 password storage. The five-stage chain deploys a Go tool called FortigateSniffer to passively intercept authentication traffic across 24 protocols, then routes harvested hashes to a GPU-accelerated cracking cluster running Hashmat and Hashtopolis before using cracked credentials for lateral movement, Active Directory enumeration, Kerberos validation and SMB authentication.
Why it matters
If your company exposes a FortiGate SSL VPN or admin interface to the internet, CISA's recommended actions are specific: terminate active SSL VPN and administrative sessions, reset Fortinet VPN and admin passwords, move administrator credential storage to PBKDF2 instead of SHA-256, enable phishing-resistant authentication, and review logs. The hashing detail is the one people skip — if admin credentials are still stored with legacy SHA-256, stolen hashes stay crackable offline, so a password reset without the PBKDF2 migration leaves the same exposure. Teams not running Fortinet gear have no action here.
Discussion angle
Does anyone in the group still run FortiGate SSL VPN or admin portals exposed to the internet, and would a password reset alone actually fix it if admin hashes are still stored with SHA-256?