FBI Warns FortiBleed Campaign Still Active, Hits 86,000+ FortiGate Devices

The FortiBleed campaign exploits credentials stolen from prior data breaches and infostealer malware logs to gain unauthorized access to FortiGate devices through credential stuffing and password spraying — techniques that succeed when organizations fail to rotate credentials after known leaks or enforce multi-factor authentication. Once inside, attackers modify account configurations and lock out legitimate administrators, effectively handing persistent control to threat actors. This campaign's link to active ransomware groups like INC Ransom and Lynx underscores the real-world damage that can stem from unaddressed credential hygiene failures. The scale — over 86,000 devices — illustrates how internet-facing network appliances with weak or reused credentials present a massive, systematic attack surface that adversaries actively exploit.