FortiBleed Attackers Lock Out Legitimate Users on Fortinet Devices

What Happened

Since June, a credential‑harvesting campaign dubbed FortiBleed has targeted internet‑accessible Fortinet FortiGate firewalls and SSL‑VPN appliances. Attackers use stolen credentials and brute‑force techniques to gain initial access, then create new administrative accounts and delete or reset existing ones, effectively locking out legitimate users.

Impact

SOCRadar confirmed 86,644 compromised devices across 194 countries, with the FBI jointly issuing an advisory. The affected devices include FortiGate firewalls, FortiGate SSL‑VPN appliances, and related Fortinet products. The attackers maintain a persistent inventory of compromised devices, enabling ongoing exploitation.

What Defenders Should Do

• Audit all Fortinet devices for unauthorized accounts and recent changes to admin credentials.
• Enforce strong, unique passwords and enable multi‑factor authentication on all Fortinet management interfaces.
• Restrict internet exposure of Fortinet devices by placing them behind a DMZ or VPN and applying strict access controls.
• Apply the latest Fortinet firmware updates and security patches as soon as they are released.
• Monitor device logs for anomalous login attempts, account creation, or deletion events.
• Implement network segmentation to isolate critical Fortinet devices from the broader network.

Immediate action is required to prevent further lock‑out of legitimate administrators and to stop the attackers from maintaining control over the compromised infrastructure.