Check Every Route Back In
A 6 October 2026 FBI-USSS warning describes FortiBleed: ongoing credential abuse against exposed FortiGate firewalls plus SSL VPN gateways, administrator lockouts and brokered access benefiting ransomware affiliates (INC/Lynx and Payload). It supplies no new zero-day, dedicated CVE or fix matrix.
Isolate, preserve evidence and scope access before informed eviction; investigation and countermeasures may then overlap. Review accounts, sessions, configuration and downstream activity together. For REST API keys, confirm purpose, remove unexpected ones and refresh legitimate keys.
The vendor’s earlier analysis recommends current supported 7.4, 7.6 or 8.0 releases, session termination, credential resets, multi-factor authentication and configuration checks. These are hardening recommendations, not verified campaign-specific fixes.
Its account guidance says successful login or a super-administrator password reset converts an existing account from SHA-256 to PBKDF2. Software capability does not prove every account migrated; legacy hashes remain by default for compatibility.
Use the applicable lockout policy to remove weaker hashes. A later downgrade lacking the newer scheme can lock administrators out if no account remains that has never logged in to generate that hash. Record migration and downgrade readiness separately.
Network indicators date from 18 June to 23 July of that year. Reassigned cloud addresses may be benign; corroborate current telemetry before blocking. Publication does not refresh observations of your environment.
