FBI Warns of FortiBleed: Stolen Firewall Logins Are Locking Businesses Out
A new FBI and Secret Service advisory says attackers are logging into exposed FortiGate firewalls and VPNs with stolen passwords, sometimes locking owners out. Here's what to check this week.
- cybersecurity
- firewall
- vpn
- fortinet
- mfa
- ransomware
- msp
- smb
- texas-it
On October 6, the FBI and U.S. Secret Service published a joint advisory on FortiBleed, an ongoing campaign aimed at internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The agencies cite security firm SOCRadar's count of more than 86,000 compromised devices across 194 countries.
This isn't a fancy zero-day. Attackers are walking in through the front door with reused, leaked, or cracked passwords, then making themselves at home.
How the attack works
- Automated scanners hunt for FortiGate VPN login pages that are reachable from the internet.
- Attackers try passwords from old breach dumps and infostealer logs (credential stuffing and password spraying).
- Once inside, they pull stored password hashes and crack them on rented GPU clusters, especially older SHA-256 hashes.
- They create new admin accounts with names like
fortiAdmin,itadmin,support_fortinet, orforticloud-syncto keep access. - In some cases they delete or change the real admin accounts, locking the business out of its own firewall.
- Access is then sold to ransomware crews. The advisory names INC/Lynx and Payload ransomware affiliates.
Why this matters for small businesses
Plenty of small offices, clinics, and job sites run a FortiGate (or a similar firewall) that was set up once and rarely touched again. The VPN still uses the same password from years ago, the admin page is open to the internet, and nobody gets an alert when a new admin account shows up. A firewall is supposed to be the lock on the door; with a stolen login, it becomes the attacker's key.
Practical next steps (this week)
- Get the admin page off the internet. The FBI ranks it plainly: trusted hosts are good, a local-in policy is better, and no internet administration at all is best.
- Kill sessions and reset passwords. End all active admin and VPN sessions, then reset every VPN and admin password, starting with internet-facing devices.
- Require phishing-resistant MFA on every VPN and admin login, such as an authenticator app with number matching or a hardware key.
- Audit the accounts. Look for admin or VPN users you don't recognize, plus unknown REST API keys, and compare the config to a known-good backup.
- Check the logs and the firmware. Review firewall, VPN, and sign-in logs for odd access, and make sure admin passwords use the stronger PBKDF2 hashing Fortinet supports in FortiOS 7.2.11 and later.
For South Texas teams on-site: find out who has the admin login to your office firewall and when it was last changed. If the answer is "the guy who installed it," that's this week's fix. For remote-managed clients nationwide: ask your MSP to confirm MFA on your VPN and send you a list of every admin account on the firewall.
Nice2GeekYou is based in San Antonio, serving all of Texas, and our managed IT plans support remote clients across the U.S. with firewall hardening, MFA rollout, log monitoring, and documented incident response. Request a quote or see our monthly plans.