FortiBleed campaign steals credentials from about 86,000 Fortinet devices

Intelligence Summary

A large-scale credential theft operation known as FortiBleed has reportedly compromised around 86,000 Fortinet device credentials. The activity appears to target roughly half of the internet-accessible Fortinet firewalls and VPN gateways. Stolen credentials can enable attackers to access management interfaces and pivot deeper into networks. The impact is amplified by the exposure of devices that are reachable from the internet. Fortinet administrators should immediately review account access, rotate credentials, and audit exposed management services.

Recommended Action

Prioritize immediate review, validate exposure, and patch or mitigate affected systems.

Topics