A recent warning from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has highlighted the vulnerability of Fortinet customers to a large-scale malicious campaign, known as FortiBleed. As of June 19, 2026, a total of 86,644 FortiGate devices have been compromised, with the majority of breached credentials being generic admin accounts and built-in Fortinet system accounts. This suggests a widespread failure to rename default accounts or rotate factory credentials, making it easy for attackers to target these devices. The attack, which is believed to be the work of Russian-speaking threat actors, uses a two-step approach to compromise devices. First, the attackers use a bespoke tool to spray known login and password combinations against identified Fortinet remote login endpoints. Once access is obtained, they passively monitor network traffic to collect additional credentials, which are then used to compromise more appliances. The compromised credentials are legitimate and valid, and the attackers verify each of them before adding them to a database of confirmed working logins. The affected sectors include telecom, government, and education, with the most exposures located in India, the U.S., Mexico, Colombia, and Thailand. To defend against this activity, CISA recommends terminating all active SSL VPN and administrative sessions, resetting all Fortinet VPN and administrative passwords, and enforcing strong password policies. Additionally, organizations should ensure the use of the Password-Based Key Derivation Function 2 (PBKDF2) algorithm to store administrator credentials and remove weaker legacy hashes. By taking these steps, organizations can reduce the attack surface and lock down management, preventing further compromise. The incident highlights the importance of proper password hygiene and the need for organizations to prioritize credential security.

Source: The Hackers News