The FBI and U.S. Secret Service have confirmed a major cybersecurity breach: over 86,644 Fortinet FortiGate firewalls across 194 countries were compromised in a single coordinated attack. If your organization or any vendor in your supply chain uses Fortinet SSL VPN gateways with internet-facing management, this is critical threat intelligence that requires immediate action.
What Changed
On October 6, 2026, the FBI and USSS issued a joint advisory about FortiBleed, a credential-compromise operation targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The attackers exploited reused credentials, outdated SHA-256 password storage, and exposed management interfaces to harvest authentication data on a large scale.
The attackers developed a sophisticated initial access broker operation. After exposing their own backend server, investigators mapped the attack chain: automated scanning for exposed portals, credential stuffing using leaked data, hash cracking with rented infrastructure, and creating persistent access through new administrative accounts.
SOCRadar data confirmed the global impact. Attackers continue scanning with previously obtained credentials, and some organizations have been locked out of their own firewalls after attackers deleted original accounts or changed passwords.
Key Findings
Legacy password storage is a vulnerability. FortiOS devices storing administrator credentials with SHA-256 hashing allowed attackers to crack passwords at scale. The advisory highlights that GPU-accelerated cracking converted stolen hashes into plaintext credentials, which were then sold to ransomware affiliates.
Internet-facing management is an attack vector. The campaign succeeded because organizations left FortiGate SSL VPN portals and management interfaces exposed to the internet without restricting access. Attackers automated the discovery process, scanning globally for exposed endpoints.
Account lockouts indicate active intrusion. Organizations losing access to their Fortinet devices may find attackers removed existing accounts to block recovery while moving laterally into the network. Recovery requires more than patching and password resets.
Indicators of organized resale. The exposed backend server showed target lists ranked by revenue, working VPN configurations for sale, and evidence that cracked credentials were supplied to ransomware affiliates. This is a supply chain for initial access, not opportunistic scanning.
Multi-stage persistence complicates remediation. Attackers created new administrative accounts, accessed Active Directory after gaining VPN access, and identified privileged accounts before selling access. If you find evidence of compromise, assume lateral movement occurred.
What This Means for Your Team
If you manage supply chain risk for a defense contractor or public-sector organization handling Controlled Unclassified Information or classified data, this advisory has direct implications:
Your vendors are targets. DFARS 252.204-7012 requires subcontractors to protect covered defense information, but many smaller firms lack resources to secure internet-facing infrastructure. If a subcontractor's Fortinet gateway was compromised, your CUI may be exposed through their network.
Credential reuse violates NIST SP 800-171. The campaign exploited reused and leaked credentials. NIST SP 800-171 Rev 2 control 3.5.7 prohibits password reuse, and 3.5.8 mandates password complexity. Legacy SHA-256 storage doesn't meet the intent of 3.5.10, which requires cryptographic protection of stored authenticators. Under CMMC 2.0, these controls map to Level 2 requirements that Third-Party Assessment Organizations will test.
MFA gaps create authorization risk. Organizations pursuing FedRAMP authorization or operating under continuous monitoring must enforce phishing-resistant multi-factor authentication on privileged accounts. The advisory's recommendation for phishing-resistant MFA aligns with NIST SP 800-53 Rev 5 control IA-2(1) and IA-2(2), requiring MFA for network and privileged access. If your provider uses Fortinet devices without phishing-resistant MFA, you inherit that risk.
Incident reporting obligations are triggered. DFARS 252.204-7012 requires contractors to report cyber incidents affecting covered defense information within 72 hours. If you discover indicators of compromise matching the advisory's IOCs, report to DoD through the DoD Cyber Crime Center and preserve forensic images. FedRAMP-authorized cloud service providers must notify their authorizing official and FedRAMP within specified timeframes.
Action Items by Priority
Immediate (within 24 hours):
Review all Fortinet FortiGate firewalls and SSL VPN gateways in your organization and across your supply chain for internet-facing management interfaces. Cross-reference IP addresses against the advisory's 13 IP addresses observed conducting brute force attacks between June 18 and July 23, 2026.
Terminate all active administrative and VPN sessions on Fortinet devices. Reset all VPN and administrative passwords immediately.
Check firewall and VPN configurations for the seven account names listed in the advisory: adminin, fortiAdmin, forticloud-sync, fgtsecure, adminsslvpn, itadmin, and roadmin. Remove any unrecognized accounts.
Within one week:
Restrict external management access through trusted host configurations or local-in policies. If feasible, remove internet-based administration entirely and require VPN access to a management VLAN.
Enforce phishing-resistant MFA on all remote access and administrative accounts. FIPS 140-2 validated hardware tokens or NIST SP 800-63B Authenticator Assurance Level 3 credentials meet this requirement for federal and defense applications.
Review all REST API keys on Fortinet devices. Remove unknown keys and refresh all legitimate keys following a key rotation schedule.
Within 30 days:
Migrate administrator credential storage to PBKDF2 on all FortiOS devices. Fortinet provides specific guidance for FortiOS v7.2.11 and later. Document this change in your System Security Plan and Plan of Action and Milestones if you're under FedRAMP or CMMC assessment.
Review firewall logs, VPN authentication logs, and domain controller logs for the timeframe covering June 2026 forward. Look for authentication from the IP addresses listed in the advisory, unusual geographic access patterns, and account creation events.
Update your supply chain risk assessments to include internet-facing infrastructure hardening as a scored criterion. Flow down the FBI/USSS mitigation guidance to all subcontractors handling covered defense information or CUI.
If you detect indicators of compromise, isolate affected hosts, scope the intrusion through your incident response plan, and report to the FBI Internet Crime Complaint Center (IC3), your local FBI field office, or your local USSS field office. Document the incident in your POA&M and notify your authorizing official if you hold a FedRAMP authorization or are in continuous monitoring.
