FBI: FortiBleed access brokers now lock victims out of their firewalls

The FBI and the US Secret Service issued a joint advisory in the week of 6 October 2026 on FortiBleed, the campaign that has targeted internet-facing Fortinet FortiGate firewalls and SSL VPN portals since June. According to SecurityWeek's reporting, the actors rely on previously compromised credentials and brute force rather than a new vulnerability.

The advisory describes a full access-broker workflow: scanning for exposed SSL VPN portals, harvesting credentials from infostealer logs and earlier dumps, cracking hashed credentials offline, verifying what works, then selling working VPN configurations and target lists to other threat actors. The new development is the lockout: attackers change the passwords of the original accounts or delete them, which blocks the owner, keeps persistence and supports lateral movement.

SecurityWeek, reporting on the advisory on 8 October, cites SOCRadar's count of about 86,644 confirmed compromised devices in 194 countries, and notes that devices breached months ago remain in the actors' inventory. Recommended steps include restricting management access, resetting every Fortinet VPN and administrative password, phishing-resistant multi-factor authentication, and a review of users, configurations, API keys and logs.

Why it matters Initial access brokers are the supply side of ransomware. Credential sets sold in June may be used in October, so a clean vulnerability scan says little about an appliance whose password was already in a stealer log. Watching the brokers' listings is a way to learn that a perimeter is for sale before a buyer uses it.