FortiBleed attacks are locking administrators out of internet-facing Fortinet FortiGate firewalls and SSL VPN gateways and supplying access to ransomware affiliates, according to an FBI and U.S. Secret Service advisory covered in fresh reporting on October 7. The agencies issued their warning on October 6 as attackers continued testing previously compromised credentials worldwide.

Fortinet described the campaign in June as reuse of credentials from earlier incidents, combined with brute-force attempts against weak passwords and accounts lacking multifactor authentication. The vendor said the activity did not represent a new Fortinet vulnerability. Its guidance calls for investigating compromised devices and checking for unauthorized configuration changes.

The joint advisory describes automated scanning, credential stuffing and password spraying using earlier leak dumps and infostealer logs. Attackers send stolen password hashes to GPU infrastructure for offline cracking, then validate recovered credentials and use them to explore victim networks.

To retain access, the operators create administrative accounts on firewalls, the agencies said. Deleting existing accounts or changing their passwords can deny legitimate administrators access. The advisory links access obtained through the campaign to INC/Lynx and Payload ransomware affiliates.

In an October 7 report, The Hacker News published an assessment from SOCRadar CISO Ensar Seker that valid exposed credentials and persistent accounts can remain useful months after harvesting. SOCRadar told the publication it had confirmed at least 12 ransomware deployments stemming from FortiBleed-derived access, encrypting hundreds of endpoints. That figure is attributed to the company.

Fortinet recommends terminating administrative and VPN sessions, resetting credentials, enabling multifactor authentication and restricting external management. It also advises reviewing logs and comparing configurations with a known good baseline, particularly for unexpected accounts. The FBI and Secret Service recommend isolating suspected compromised devices and collecting evidence to guide remediation. Their advisory includes observed IP addresses and account names for investigation.