FortiBleed attacks reportedly lock out FortiGate VPN administrators

Administrator accounts altered after entry

According to the report, attackers use previously leaked credentials or credentials obtained through infostealer logs, credential stuffing, and password spraying to access exposed endpoints.

The FBI says that, in some incidents, attackers create administrator accounts, delete existing administrator accounts or change their passwords, then establish persistence and attempt lateral movement. The report also says the attack chain has been observed as an initial entry point for ransomware affiliates.

The supplied report does not establish a directly comparable prior condition or measure for these incidents.

The FBI warning, as described by BleepingComputer, says FortiBleed activity is ongoing and can deny legitimate administrators access to exposed FortiGate firewalls and SSL VPN gateways.

Recovery may extend beyond patches and password resets

The reported activity is not limited to unauthorized login access: it may prevent legitimate administrators from managing affected devices while attackers retain access. The FBI warning described in the report says remediation may require measures beyond patching and resetting Fortinet passwords.