# FortiBleed: Ongoing Credential-Harvesting Campaign Against Fortinet FortiGate Firewalls and SSL VPN Gateways Feeds INC/Lynx and Payload Ransomware Access (FBI/USSS Alert)

> The FBI and Secret Service warn that the FortiBleed campaign against internet-facing Fortinet firewalls and VPN gateways remains active. Attackers can disable accounts, change passwords and lock out legitimate users, and the access has been used as an entry point by ransomware affiliates including INC/Lynx and Payload.

- **Published:** 2026-10-06T00:00:00Z
- **Last reviewed:** 2026-10-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2989
- **ID:** TL-2026-2989
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** SantaAd
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-24858, CVE-2025-59718, CVE-2025-59719

## Description

FortiBleed is a credential-exposure and initial-access campaign against internet-facing Fortinet FortiGate firewalls and FortiOS SSL VPN gateways. It was first publicly reported in mid-June 2026 (researcher Volodymyr 'Bob' Diachenko; sources give June 13-15) after an exposed server revealed a database of device URLs and working administrator and VPN credentials. Reported scale: 73,000-86,644 verified compromised devices across 194 countries (SOCRadar, CSA, Arctic Wolf), with later SOCRadar research putting the number of targeted FortiGate firewalls at roughly 430,000. India and the United States account for about one third of entries; telecommunications, government, healthcare, finance, energy and IT services are heavily represented.

Reported attack chain: (1) mass scanning for exposed management and VPN interfaces (Masscan, Shodan); (2) credential stuffing and brute force using passwords from prior breaches and infostealer logs; (3) export of device configuration files, whose legacy salted SHA-256 administrator password hashes were cracked offline on a roughly 45-GPU cluster managed with Hashtopolis (PBKDF2 hashing was introduced in FortiOS 7.2.11, 7.4.8 and 7.6.1, but legacy hashes persist until each admin logs in after upgrade); (4) login with valid credentials and deployment of a custom Go tool, FortigateSniffer, that abuses the native 'diagnose sniffer packet' command to passively capture authentication traffic (RADIUS, NTLM, Kerberos and others across 24 protocols) from about 12,000 devices; (5) reuse of harvested credentials against Active Directory, RADIUS servers and domain controllers, creation of persistent VPN tunnels and rogue admin or VPN accounts, and extraction of routing and network details. Fortinet has said there is no patch that closes this exposure and describes the activity as credential reuse and brute force against devices with weak passwords and no MFA, not a new vulnerability. Some third parties additionally link early footholds to FortiCloud SSO authentication bypasses CVE-2025-59718, CVE-2025-59719 and CVE-2026-24858 (CVSS 9.4, in CISA KEV); Fortinet states the campaign is not related to a recent advisory, so the CVE role is contested.

Attribution: SOCRadar (2026-07-02) assessed a financially motivated Russian-speaking initial access broker (roughly 20 people) and linked it to INC Ransom and Lynx after an operator with access to FortiBleed infrastructure was seen logged into both groups' negotiation panels; SOCRadar counted 409 admin-level accesses, 354 full compromises and at least 12 ransomware deployments. A CSA research note names the broker 'SantaAd' (single-source). The FBI/Secret Service alert of 2026-10-06 (as reported by CyberScoop) says the campaign remains active, that actors can disable accounts or change passwords to lock victims out, requiring remediation beyond patching and password resets, and that the access has served INC/Lynx and Payload ransomware affiliates and initial access brokers. The alert requests attacker IPs and usernames from victims but, per available reporting, publishes no IOCs.

## MITRE ATT&CK

- T1595 Active Scanning
- T1589.001 Gather Victim Identity Information: Credentials
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1133 External Remote Services
- T1110.004 Brute Force: Credential Stuffing
- T1110.002 Brute Force: Password Cracking
- T1040 Network Sniffing
- T1602.002 Network Device Configuration Dump
- T1136.001 Create Account: Local Account
- T1098 Account Manipulation
- T1021 Remote Services
- T1550.002 Use Alternate Authentication Material: Pass the Hash
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1531 Account Access Removal

## Sources

- [Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks (CyberScoop)](https://cyberscoop.com/fortibleed-fortinet-vpn-ransomware-fbi-warning/)
- [FBI/Secret Service FortiBleed alert (IC3 CSA 2026/261006)](https://www.ic3.gov/CSA/2026/261006.pdf)
- [Fortinet PSIRT: Analysis of Reported Credential Compromise of FortiGate Devices](https://www.fortinet.com/blog/psirt-blogs/analysis-of-reported-credential-compromise-of-fortigate-devices)
- [SOCRadar: FortiBleed - The Campaign That Cracked 86,644 Firewalls](https://socradar.io/blog/fortibleed-fortinet-firewalls-compromised/)
- [Arctic Wolf: Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries](https://arcticwolf.com/resources/blog/active-fortibleed-campaign-impacting-fortinet-devices-across-194-countries/)
- [Bitdefender: Technical Advisory - FortiBleed Credential Exposure Campaign](https://businessinsights.bitdefender.com/technical-advisory-fortibleed-credential-exposure-campaign-targeting-internet-facing-fortinet-devices)
- [SecurityWeek: Fortinet Responds to FortiBleed Campaign](https://www.securityweek.com/fortinet-responds-to-fortibleed-campaign/)
- [CSA Research Note: FortiBleed Default Credential Exploitation and Mass Fortinet Compromise](https://labs.cloudsecurityalliance.org/research/csa-research-note-fortibleed-default-credentials-20260620-cs/)
- [CSA Research Note: FortiBleed - Anatomy of a 110-Million-Credential Harvesting Campaign](https://labs.cloudsecurityalliance.org/research/csa-research-note-fortibleed-network-infrastructure-credenti/)
- [Cybersecurity Dive: FortiBleed campaign traced to INC and Lynx ransomware operations](https://www.cybersecuritydive.com/news/fortibleed-campaign-traced-to-inc-and-lynx-ransomware-operations/824348/)
- [RH-ISAC: FortiBleed Credential Theft Campaign Attributed to INC and Lynx Ransomware Groups](https://rhisac.org/threat-intelligence/fortibleed-credential-theft-campaign-attributed-to-inc-and-lynx-ransomware-groups)
- [Picus Security: FortiBleed - Inside the Campaign That Cracked 75,000 Fortinet Firewalls](https://www.picussecurity.com/resource/blog/fortibleed-inside-the-campaign-that-cracked-75000-fortinet-firewalls)
- [eSentire: FortiBleed Campaign - Credentials Exposed for 80,000 Fortinet Appliances](https://www.esentire.com/security-advisories/fortibleed-campaign-credentials-exposed-for-80-000-fortinet-appliances)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2989