Fortinet Ransomware: FortiBleed Campaign Locks Out Admins, Enables Ransomware Access (October 2026)

Fortinet: What Happened

In October 2026, a coordinated ransomware campaign dubbed "FortiBleed" targeted Fortinet firewalls worldwide, resulting in the compromise of over 86,000 internet-facing devices. Threat actors exploited a vulnerability in Fortinet appliances, leveraging previously leaked credentials to perform credential stuffing and password spraying attacks. Once inside, attackers systematically deleted or altered administrator passwords, effectively locking out legitimate admins and seizing control of the devices. The compromised access was then sold to ransomware affiliates associated with the INC/Lynx and Payload groups, facilitating further malicious activity.

Attack Vector & Technical Detail

The initial intrusion was achieved through exploitation of the FortiBleed vulnerability, with attackers utilizing a combination of credential stuffing and password spraying against Fortinet firewalls exposed to the internet. Leaked Fortinet credentials served as the primary entry point, allowing adversaries to bypass authentication controls. Upon successful access, the attackers enumerated Active Directory accounts, aligning with MITRE ATT&CK tactics TA0001 (Initial Access), TA0008 (Lateral Movement), TA0005 (Defense Evasion), and TA0043 (Reconnaissance). The campaign did not reference specific CVEs or IOCs in the initial advisory, but the attack methodology was consistent with previous credential-based exploitation of network appliances.

Confirmed Impact

The FortiBleed campaign resulted in widespread administrative lockout across more than 86,000 Fortinet devices globally, affecting organizations in multiple sectors and regions. Victims faced significant operational disruption, as remediation required more than standard patching—often necessitating device resets, credential audits, and network segmentation. The sale of access to ransomware affiliates introduced a heightened risk of lateral movement and subsequent ransomware deployment, exposing organizations to potential data loss, regulatory scrutiny, and business continuity threats. The campaign’s global reach underscores the systemic risk posed by exposed network infrastructure and credential reuse.

What This Means for Your Organization

Organizations operating Fortinet firewalls or similar network appliances should recognize the elevated risk posed by credential-based attacks, particularly when devices are internet-facing. The FortiBleed campaign demonstrates that previously leaked credentials remain a persistent threat vector, especially when combined with automated attack techniques. Immediate review of credential hygiene, multi-factor authentication enforcement, and minimization of public device exposure are critical. Proactive monitoring for unauthorized administrative changes and anomalous authentication attempts is essential to detect and contain similar threats.

Detection & Response

• Immediate: Audit all Fortinet firewall administrator accounts for unauthorized changes and reset credentials using secure channels.
• Hunt: Investigate for evidence of credential stuffing or password spraying activity, focusing on failed login attempts and anomalous account enumeration.
• Patch: N/A (Remediation requires credential resets and device hardening; no specific CVE fix detailed in advisory).

Source: https://www.helpnetsecurity.com/2026/10/07/fortinet-fortibleed-campaign-fbi-advisory/