FBI warns ongoing FortiBleed attacks target Fortinet VPNs and lock out administrators

The Federal Bureau of Investigation and the Secret Service issued a warning that FortiBleed attacks are actively targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, according to reports from BleepingComputer, The Hacker News, and The Record. BleepingComputer and Cybersecurity Dive reported that the credential harvesting campaign is locking legitimate administrators out of their devices. [1][2][4][6]

The Hacker News reported that the campaign has targeted tens of thousands of devices, while CyberSecurityNews reported that more than 80,000 devices have been compromised. According to The Hacker News, federal authorities confirmed the campaign remains an active threat after amassing credentials from 86,644 Fortinet devices. [5][6]

According to BleepingComputer, hackers initial access begins by using previously leaked credentials, infostealer logs, credential stuffing, and password spraying attacks against exposed endpoints. Hackers then extract additional authentication data from compromised units and run offline cracking attempts against the stolen password hashes using Hashcat and Hashtopolis on distributed GPU clusters. [1]

Fortinet is an American cybersecurity company headquartered in Sunnyvale, California, that develops and sells security products including firewalls, endpoint security, and intrusion detection systems. [9]