FortiBleed Campaign Targets Firewalls Worldwide

Affected Environment

Fortinet FortiGate firewalls and VPN appliances with internet-exposed management interfaces across all sectors globally.

Threat Overview

Large-scale automated credential abuse campaign targeting Fortinet devices using leaked, reused, or default credentials.

Exposure Timeline

Active and ongoing campaign; tens of thousands of devices already compromised across hundreds of countries.

Attack Surface

Internet-exposed Fortinet management interfaces susceptible to automated credential stuffing at scale.

Technical Root Cause

Weak, reused, or default credentials without MFA; older password hashing standards (non-PBKDF2) in FortiOS.

Exploitation Pathway

Actors scan for exposed interfaces, authenticate with verified credentials, gaining full legitimate administrative access.