FBI and Secret Service: FortiBleed campaign remains active

The FBI and Secret Service warned that the FortiBleed credential compromise campaign against Fortinet firewalls and VPN gateways is still active, with attackers locking out legitimate owners and using stolen credentials as an initial entry point for ransomware. SOCRadar verified more than 86,644 compromised devices across 194 countries, and later investigation identified up to 450,000 targeted firewalls.

• FBI and Secret Service confirm FortiBleed is still an active threat
• SOCRadar verified 86,644 compromised devices across 194 countries
• Later investigation identified up to 450,000 targeted firewalls
• The attack serves as an entry point for INC/Lynx and Payload ransomware affiliates