FBI and Secret Service Warn of FortiBleed Theft Against Fortinet Hardware

En bref

• FBI and Secret Service issued alerts about FortiBleed activity.
• Two categories of Fortinet hardware are linked to credential theft and exposure concerns.
• No CVE identifiers are associated with this campaign, so standard patch tracking is not enough.
• The campaign is global in scope, affecting organizations with internet-facing Fortinet devices.
• Admins should reduce management exposure and rotate credentials now.

U.S. federal agencies, including the FBI and the Secret Service, have raised alarms about a global operation known as FortiBleed. The activity centers on Fortinet hardware, with two hardware categories identified as relevant to the warnings. Rather than relying on a software vulnerability with a CVE identifier, the campaign appears to exploit exposure and credential weaknesses, making it a configuration and access-control problem as much as a product issue.

Organizations that run Fortinet appliances are in scope, especially those with administrative interfaces reachable from the internet. The primary impact described is credential theft, which can give intruders a foothold for lateral movement, persistence, and further data access. Because the campaign is not tied to a specific CVE, teams cannot simply wait for a patch cycle or rely on vulnerability scanners to surface the risk.

The warnings matter because stolen credentials can bypass many perimeter defenses and blend into normal administrative activity. A single exposed management portal or reused password can become the entry point for a broader intrusion. The global nature of the campaign means smaller agencies, school districts, and enterprises alike should assume they are potential targets if Fortinet gear is present.

What to watch: unusual login attempts, new or modified admin accounts, configuration changes, and outbound traffic from network devices. Administrators should also monitor vendor guidance and threat feeds for FortiBleed indicators. The immediate priority is to limit exposure, rotate secrets, and verify that only trusted networks can reach management services. If compromise is suspected, preserve logs and contact federal authorities for support.

À faire maintenant

1. Build an inventory of every Fortinet device, flag the two affected hardware categories, and identify which management interfaces are reachable from untrusted networks.
2. Immediately disable WAN-side administration, restrict management access to trusted internal networks or VPN, and enforce multi-factor authentication for all administrative accounts.
3. Rotate passwords, API tokens, certificates, and any secrets stored on or used by Fortinet hardware; remove stale or unknown accounts.
4. Review device and authentication logs for suspicious sign-ins, configuration edits, new admin users, and unexpected outbound connections; preserve evidence.
5. Apply the latest Fortinet hardening guidance and firmware updates even though no CVE is tied to this campaign, then re-check exposure after changes.
6. Segment network management traffic, add monitoring for FortiBleed indicators, and test whether credential reuse could enable lateral movement.
7. Brief leadership and IT staff on the campaign, establish an incident contact path, and report suspected compromises to the FBI or Secret Service.

Source originale

The Record