INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Firewalls in 194 Countries Breached Using Stolen Passwords

| 2026-10-07 07:13 HIGH HIGH DATA BREACH
JSON
Executive Summary
AI-generated
A global credential-compromise campaign, known as FortiBleed, has been detected targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways in 194 countries. The attackers, who have supplied access to ransomware affiliates including INC/Lynx ransomware and Payload ransomware, initially gathered credentials through credential stuffing and password spraying using prior Fortinet leak dumps and infostealer logs. They then used these stolen credentials to delete original accounts or change passwords on affected devices, potentially locking out victims from their systems. The attack chain involved scanning exposed firewalls with automated scripts, cracking authentication data at scale using GPU-accelerated tools, and selling access to downstream threat actors. As of October 7, 2026, over 86,644 Fortinet firewalls have been compromised, with the FBI and U.S. Secret Service issuing a joint advisory warning organizations about this active global campaign.
Technical Mitigations AI-generated
• Use PBKDF2 to store administrator credentials and remove weaker legacy hashes. • Terminate all active admin and VPN sessions and reset all Fortinet VPN and administrative passwords. • Enforce phishing-resistant MFA on all remote access and administrative accounts. • Review firewall, VPN configurations for unrecognized accounts and unauthorized changes.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 5 IoCs Create Free Account
45.154.•••.•••
85.11.•••.•••
45.155.•••.•••
154.202.•••.•••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
‎July 23, 2026
Threat actors used stolen FortiAdmin passwords to breach 86,644 firewalls in 194 countries.
organisation Enforce
Enforce phishing-resistant MFA on all remote access and administrative accounts.
organisation MFA
Enforce phishing-resistant MFA on all remote access and administrative accounts.
organisation Recommended Mitigations Against FortiBleed The
Recommended Mitigations Against FortiBleed The FBI and USSS recommend that organizations: Restrict external management through trusted hosts, a local-in policy, or by removing internet administration entirely.
organisation Crime Complaint Center
Organizations that detect a compromise are urged to isolate affected hosts, scope the intrusion and report incidents to the FBI’s Internet Crime Complaint Center (IC3), a local FBI field office or a local USSS field office.
organisation fortiAdmin
Account names found on victim systems include adminin, fortiAdmin, forticloud-sync, fgtsecure, adminsslvpn, itadmin and roadmin.
‎October 6, 2026
Threat actors used stolen passwords to target Fortinet devices across 194 countries, breaching over 86,644 firewalls and exfiltrating password hashes that were then cracked using GPU-accelerated tools.
infrastructure 86,644 compromised devices
The advisory, published on October 6, 2026, cites SOCRadar data verifying more than 86,644 compromised devices across 194 countries.
general_metric 194 countries
The advisory, published on October 6, 2026, cites SOCRadar data verifying more than 86,644 compromised devices across 194 countries.
organisation Ransomware
FortiBleed Lockouts and Ransomware Links The advisory warns that victims may lose access to their Fortinet devices if attackers delete original accounts or change their passwords.
organisation INC/Lynx
Reporting also indicates that initial access brokers using the FortiBleed attack chain have supplied access to ransomware affiliates, currently including INC/Lynx ransomware and Payload ransomware.
infrastructure Fortigate
Attackers first scanned the internet for exposed FortiGate SSL VPN portals using automated scripts.
organisation Fortinet
Attackers continue to scan exposed Fortinet firewalls using previously obtained credentials, and some affected organizations have been locked out of their own systems.
organisation Password
Password hashes taken from compromised devices were exfiltrated and fed into a GPU-accelerated cracking cluster running on rented infrastructure, where Hashcat and Hashtopolis ran distributed jobs to convert stolen data into plaintext credentials.
organisation fed
Password hashes taken from compromised devices were exfiltrated and fed into a GPU-accelerated cracking cluster running on rented infrastructure, where Hashcat and Hashtopolis ran distributed jobs to convert stolen data into plaintext credentials.
organisation GPU
Password hashes taken from compromised devices were exfiltrated and fed into a GPU-accelerated cracking cluster running on rented infrastructure, where Hashcat and Hashtopolis ran distributed jobs to convert stolen data into plaintext credentials.
organisation Hashcat
Password hashes taken from compromised devices were exfiltrated and fed into a GPU-accelerated cracking cluster running on rented infrastructure, where Hashcat and Hashtopolis ran distributed jobs to convert stolen data into plaintext credentials.
organisation FortiBleed Indicators of Compromise The
FortiBleed Indicators of Compromise The agencies released indicators of compromise (IOCs) to help defenders review their environments.
‎between June 18 and July 23, 2026
Thirteen IP addresses conducted brute force attacks or authenticated with compromised accounts between June 18 and July 23, 2026.
organisation IP
The advisory also lists 13 IP addresses observed between June 18 and July 23, 2026, conducting brute force attacks or authenticating with compromised accounts.
infrastructure 13 IP addresses
The advisory also lists 13 IP addresses observed between June 18 and July 23, 2026, conducting brute force attacks or authenticating with compromised accounts.
‎2026/10/07
Threat actors used stolen Fortinet credentials to target 86,644 internet-facing FortiGate firewalls and SSL VPN gateways in 194 countries.
infrastructure Fortigate
The FBI and the U.S. Secret Service (USSS) have issued a joint cybersecurity advisory warning organizations about FortiBleed, an active global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways.
organisation the U.S. Secret Service
The FBI and the U.S. Secret Service (USSS) have issued a joint cybersecurity advisory warning organizations about FortiBleed, an active global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways.
organisation USSS
The FBI and the U.S. Secret Service (USSS) have issued a joint cybersecurity advisory warning organizations about FortiBleed, an active global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways.
organisation FortiBleed
The FBI and the U.S. Secret Service (USSS) have issued a joint cybersecurity advisory warning organizations about FortiBleed, an active global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways.
organisation SSL
The FBI and the U.S. Secret Service (USSS) have issued a joint cybersecurity advisory warning organizations about FortiBleed, an active global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways.
Tactical Metrics
Metrics
infrastructure
‎Fortigate
Affected Product
The FBI and the U.S. Secret Service (USSS) have issued a joint cybersecurity advisory warning organizations about FortiBleed, an active global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways.
Attackers first scanned the internet for exposed FortiGate SSL VPN portals using automated scripts.
Metrics
infrastructure
86,644
Compromised Devices
The advisory, published on October 6, 2026, cites SOCRadar data verifying more than 86,644 compromised devices across 194 countries.
Metrics
infrastructure
13
Ip Addresses
The advisory also lists 13 IP addresses observed between June 18 and July 23, 2026, conducting brute force attacks or authenticating with compromised accounts.
Intelligence Sources
The Cyber Express 2026-10-07