FortiBleed Attackers Lock Out Admins to Secure Persistent Access
FBI investigation reveals attackers delete firewall accounts to block remediation, forcing victims to reset hardware while operators maintain control.
Key points
- More than 80,000 FortiGate devices have been affected by the ongoing campaign.
- Attackers delete administrative accounts to lock legitimate users out of their systems.
- Compromised access is being sold to ransomware groups like INC/Lynx and Payload.
The risk
The Federal Bureau of Investigation and the US Secret Service have disclosed new operational details regarding the FortiBleed campaign, which has impacted over 80,000 devices globally. According to the joint advisory, attackers are now deleting or changing passwords for existing administrative accounts on FortiGate firewalls. This tactic effectively locks legitimate administrators out of their own security infrastructure while the threat actors remain logged in.
Investigators gained access to a backend server left exposed by the attackers, revealing the full scope of the operation. The infrastructure included systems designed to process stolen credentials, crack password hashes, and identify potential targets. The FBI noted that operators ranked organizations based on revenue and network structure before launching intrusions.
Muhammad Yahya Patel, vCISO at Huntress, stated that the situation has shifted from a vulnerability issue to a persistence problem. He emphasized that credentials were stolen months ago and organizations must determine if those credentials are still active. Ben Bernstein, a manager at Huntress, warned that victims cannot simply patch the software to regain access.
Who is exposed
The campaign specifically targets Fortinet FortiGate devices. The FBI’s advisory indicates that attackers create new administrative accounts that were not previously present on the device. In some instances, they subsequently delete existing accounts to prevent organizational persistence and facilitate lateral movement through the environment.
This lockout capability presents an immediate operational risk. When administrators lose access to their firewall, they cannot apply standard software updates. According to Huntress, attackers are aware that organizations will be forced to physically factory reset and rebuild the hardware before encryption can begin.
Cost and compliance
The compromised access obtained through this campaign is being offered to ransomware affiliates. The FBI specifically named INC/Lynx and Payload ransomware groups as recipients of these stolen credentials. This monetization strategy highlights the financial incentive behind the persistent intrusion.
Attackers have also enumerated Active Directory environments and used compromised credentials for lateral movement. The FBI’s newly published account names and infrastructure indicators are intended to help organizations investigate potential compromise. The agency recommended reviewing Fortinet accounts and configurations for unauthorized changes.
What happens next
Organizations should check firewall, VPN, authentication, and domain controller logs for suspicious activity. The FBI advised looking for unknown or unexpected REST API keys that could provide attackers with automated access to FortiGate systems. Immediate verification of administrative account integrity is critical.
Background: Firewalls
Firewalls are important because they enforce access policies at network boundaries, blocking unauthorized traffic before it reaches your devices. Without this filter, your systems face constant probing. This reduces the attack surface and prevents automated exploits from finding vulnerable services.
Read the full guide: Why Firewalls Are Important: The Hidden Costs of Missing Filters
What to do and how to stay safe: Fortinet
- Review all FortiGate administrative accounts for unauthorized additions or recent password changes.
- Audit firewall logs for unexpected REST API key creations or usage patterns.
- Check domain controller logs for signs of lateral movement using compromised credentials.
- Verify that no unknown administrative accounts have been added to your network devices.
Step-by-step guide: Phishing Myths Debunked: Why Common Beliefs Leave You Vulnerable
General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many devices are affected by FortiBleed?
The FBI and US Secret Service report that more than 80,000 devices worldwide have been affected by the ongoing campaign.
Why can't victims just patch their firewalls?
Attackers delete existing administrative accounts, locking legitimate users out. Victims must physically factory reset the hardware to regain control.
Are ransomware groups involved?
Yes, the FBI stated that access obtained through the campaign is being offered to ransomware affiliates, including INC/Lynx and Payload.
