The new admin is called support_fortinet

The usual advice after a credential leak is to reset the passwords. The FBI and the US Secret Service said on Tuesday that for some victims of FortiBleed, that may no longer be possible. "Affected organizations may find themselves locked out of their systems if threat actors disable accounts or change passwords, requiring remediation steps beyond standard patching and password resets," the agencies wrote in a joint advisory published on 6 October.

FortiBleed is the name given to a credential-harvesting operation aimed at internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The advisory calls it "an active, global credential-compromise campaign" and cites the threat-intelligence firm SOCRadar's verification of more than 86,644 compromised devices across 194 countries. It was documented in June, and, according to the agencies, it became visible "only after the threat actors unintentionally exposed their own backend server." The exposed directory showed the whole pipeline: scanning for FortiGate SSL VPN portals, credential stuffing and password spraying using earlier Fortinet leak dumps and infostealer logs, extraction of password hashes from compromised devices, and offline cracking on a rented GPU cluster run with Hashcat and Hashtopolis.

Two lines in the advisory explain why this has gone on so long. The campaign "exploits reused or leaked credentials and a legacy SHA-256 password storage, enabling threat actors to harvest and crack authentication data at scale." And the cracked credentials were not used indiscriminately: they "were enriched, sorted, and validated, with scripts filtering out honeypots, mapping organizations, and prioritizing high-value targets based on revenue and network structure." When CISA warned Fortinet customers after the campaign came to light, it urged them to store administrator credentials using the stronger PBKDF2 algorithm, The Hacker News reported. That is a configuration change, not a patch, and it does not help a device whose hashes have already been taken.

The new element is the lockout. "During the initial intrusion, threat actors create new accounts not previously on the device," the agencies write. "In certain cases, threat actors delete existing accounts to block organizations from accessing affected devices and to maintain persistence on the system while attempting lateral movement within the environment." The advisory includes a table of account names found on victims' devices, several of which mimic vendor or support accounts: support_fortinet, forticloud-sync, forticloud-tech, fortiAdmin, adminsslvpn, IT_Manager, Technical_support and roadmin among them. The agencies recommend that every organisation review all Fortinet accounts and verify their legitimacy.

The other element is where the access goes. According to the advisory, initial access brokers using the FortiBleed attack chain "have provided further access to ransomware affiliates, currently including INC/Lynx ransomware and Payload ransomware." SOCRadar said in July that it had seen at least 12 confirmed ransomware attacks stemming from the campaign, The Register reported. Ensar Seker, SOCRadar's chief information security officer, told CyberScoop that "in our later investigation, we identified more than 400,000 or 450,000 firewalls targeted by the wider operation." He added: "What stands out for me is that FortiBleed is still an active threat, and attackers are using stolen credentials to access the exposed Fortinet devices, create new administration accounts, and in some cases, lock the real owners out."

One detail in the document is worth reading closely. The table of IP addresses the agencies say were conducting brute-force attacks or authenticating with compromised accounts lists observation dates from 18 June to 23 July 2026. The advisory itself warns that such addresses may since have been reassigned and should be checked against current telemetry. On our reading, defenders who simply block that list will be blocking the summer's infrastructure; the advisory's statement that "attackers are continuing to scan internet-exposed Fortinet firewalls using previously obtained compromised credentials" is the part that describes October.

Part of the guidance is ranked. On management access, restricting it to trusted hosts is "good", a local-in policy is "better", and removing internet administration altogether is "best". Beyond that, the agencies ask organisations to terminate all active administrative and VPN sessions, reset all Fortinet VPN and administrative passwords, and require phishing-resistant multi-factor authentication on every remote-access and administrative account. Where a compromise is found, they recommend isolating the affected hosts, hunting for the intruder's activity before starting eviction, and reporting to the FBI or Secret Service.

The advisory says it applies to all 16 critical infrastructure sectors, from dams and nuclear reactors to water and healthcare. Its underlying message is that FortiBleed was never a single vulnerability with a single fix. The stolen credentials are already circulating, and the agencies' first recommendation is to lock down management access, ideally by taking it off the internet, ahead of resetting passwords.