Threat Overview
A joint FBI and U.S. Secret Service advisory dated 6 October 2026 describes ongoing FortiBleed operations against Internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The campaign leverages previously leaked or reused credentials, credential stuffing, password spraying, and legacy SHA-256 password hashes exposed in stolen configuration data. The advisory cites SOCRadar verification of more than 86,644 compromised devices in 194 countries, a historical measurement rather than a fresh count of newly compromised devices. Attackers validate access, create new firewall administrators, may remove or change original administrator accounts to lock out defenders, and can expand into Active Directory environments. The advisory links initial-access broker activity to downstream INC/Lynx and Payload ransomware affiliates. This is not a newly assigned FortiOS zero-day; patching alone may not evict access obtained with valid credentials or surviving API keys.
References
FBI / U.S. Secret Service — joint cybersecurity advisory, 6 Oct 2026
The Hacker News — advisory coverage, 7 Oct 2026
Fortinet — analysis of reported credential compromise
Impacted Systems
**Vendor/product:** Fortinet FortiGate running FortiOS; Internet-facing SSL VPN gateways and exposed administrative interfaces. **Deployment:** customer-managed hardware/virtual firewalls, not FortiAnalyzer itself. **Prerequisites:** stolen/reused credentials, accessible login surfaces, or legacy hashes obtained from previous device/configuration compromise; no single new vulnerable FortiOS version or universal CVE is established by this advisory. **Relevant versions:** Fortinet documentation describes PBKDF2 admin-password storage introduced in FortiOS 7.2.11, 7.4.8 and 7.6.1, but upgraded systems may retain legacy hashes until passwords are changed/rehashed. **Fixed version:** no single patch/build cures stolen credentials; use supported FortiOS and enforce credential/API-key rotation. **Ports:** VPN/admin interface ports are deployment-specific; some reported actor beacon traffic used 4332/4432.
Why this matters
Exposed security gateways provide privileged access to internal networks. Continued use of previously compromised credentials, creation of new admin accounts, and lockouts can persist despite firmware updates and lead to ransomware intrusions.
Exploitation Status
**Confirmed government reporting:** FBI/USSS describe an ongoing credential-compromise campaign and administrator lockouts; historical June–July IPs and usernames are included in the advisory. **Third-party measurement:** 86,644 is SOCRadar-verified historical exposure, not a current live compromised-host census. **Assessment:** reported attacker IPs and usernames are corroboration aids, not standalone proof. The campaign is not established as exploitation of CVE-2024-23113 or any single newly disclosed FortiOS vulnerability.
What this hunt looks for
Available Microsoft Sentinel Fortinet firewall event telemetry, CEF/CommonSecurityLog, Syslog, network egress, and Windows SecurityEvent logs where ingested. FortiAnalyzer inventory alone does not prove FortiGate admin events are forwarded or normalized into CommonSecurityLog.
Required logs
CommonSecurityLog FortiGate VPN/authentication failure logs and SourceUserName; CommonSecurityLog network flow; ports alone are weak signals; CommonSecurityLog with FortiGate administration audit messages; CommonSecurityLog with administrative usernames in normalized or raw text; CommonSecurityLog with source/destination IPs; IOCs historical June-July 2026; FortiGate configuration logs forwarded to CommonSecurityLog; SecurityEvent 4625 with source IP and target username populated; SecurityEvent account-management auditing; requires incident correlation; Syslog containing FortiOS device events; may need connector-specific parser
Hunt 1: First pass — FortiGate administrative account additions or deletions
Required telemetry: CommonSecurityLog with FortiGate administration audit messages
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DeviceVendor has "Fortinet" or DeviceProduct has "FortiGate"
| extend Detail=strcat(tostring(column_ifexists("Message",""))," ",tostring(column_ifexists("AdditionalExtensions",""))," ",tostring(DeviceEventClassID))
| where Detail has_any ("admin","administrator","user","account") and Detail has_any ("add","added","create","created","delete","deleted","change","modified")
| project TimeGenerated, DeviceName, SourceIP, SourceUserName, DeviceAction, DeviceEventClassID, Detail
| order by TimeGenerated descHunt 2: FBI/USSS-reported FortiBleed infrastructure in perimeter traffic
Required telemetry: CommonSecurityLog with source/destination IPs; IOCs historical June-July 2026
let IOCs=dynamic(["45.154.12.132","154.202.59.169","103.27.186.156","45.155.250.158","193.8.187.2","193.8.187.42","85.11.187.8","104.28.155.27","185.136.15.43","185.136.15.66","185.199.199.56","193.8.186.33","45.227.254.210","77.91.118.10","80.75.212.113","87.251.64.13","87.251.64.16","87.251.64.17","87.251.64.44","66.175.220.111"]);
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where SourceIP in (IOCs) or DestinationIP in (IOCs)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceVendor, DeviceProduct, DeviceAction, DeviceName
| order by TimeGenerated descHunt 3: FortiGate authentication failures and spraying across usernames
Required telemetry: CommonSecurityLog FortiGate VPN/authentication failure logs and SourceUserName
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DeviceVendor has "Fortinet" or DeviceProduct has "FortiGate"
| extend Detail=strcat(tostring(column_ifexists("Message",""))," ",tostring(column_ifexists("AdditionalExtensions","")))
| where Detail has_any ("login","authentication","auth","vpn")
| where Detail has_any ("fail","failed","denied","invalid")
| summarize Failures=count(), Users=dcount(SourceUserName), UserSamples=make_set(SourceUserName,8), Targets=make_set(DestinationIP,8) by SourceIP, bin(TimeGenerated,1h)
| where Failures >= 15 or Users >= 5
| order by Failures descHunt 4: FortiGate reported rogue administrator names
Required telemetry: CommonSecurityLog with administrative usernames in normalized or raw text
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DeviceVendor has "Fortinet" or DeviceProduct has "FortiGate"
| extend Detail=strcat(tostring(column_ifexists("Message",""))," ",tostring(column_ifexists("AdditionalExtensions",""))," ",tostring(SourceUserName))
| where Detail has_any ("forticloud-tech","forti_support2","fortiAdmin","adminsslvpn","support_fortinet","forticloud-sync","fgtsecure","system_config","districtadmin","gttadmin","roadmin","pakedge","itadmin","IT_Manager","fgtsec")
| project TimeGenerated, DeviceName, SourceIP, SourceUserName, DeviceEventClassID, Detail
| order by TimeGenerated descHunt 5: FortiGate API-token and management configuration changes
Required telemetry: FortiGate configuration logs forwarded to CommonSecurityLog
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DeviceVendor has "Fortinet" or DeviceProduct has "FortiGate"
| extend Detail=strcat(tostring(column_ifexists("Message",""))," ",tostring(column_ifexists("AdditionalExtensions","")))
| where Detail has_any ("api-user","api_user","api","token","trusted-host","super_admin","mfa","two-factor","ssh")
| where Detail has_any ("add","create","delete","change","edit","modify","set","unset","login")
| project TimeGenerated, DeviceName, SourceIP, SourceUserName, DeviceEventClassID, Detail
| order by TimeGenerated descHunt 6: FortiGate Syslog fallback — admin creation, lockout, and SSH access
Required telemetry: Syslog containing FortiOS device events; may need connector-specific parser
Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("fortigate","fortios","forticloud","adminsslvpn","forti_support2","super_admin") or ProcessName has "forti"
| where SyslogMessage has_any ("login","admin","user","ssh","password","disabled","delete","added","created")
| project TimeGenerated, Computer, ProcessName, SeverityLevel, SyslogMessage
| order by TimeGenerated descHunt 7: Windows follow-on password spraying after VPN compromise
Required telemetry: SecurityEvent 4625 with source IP and target username populated
SecurityEvent
| where TimeGenerated >= ago(7d) and EventID == 4625
| extend IP=tostring(column_ifexists("IpAddress","")), Target=tostring(column_ifexists("TargetUserName",""))
| where isnotempty(IP) and IP !in ("-","127.0.0.1","::1")
| summarize Failures=count(), Accounts=dcount(Target), SampleAccounts=make_set(Target,8), Hosts=dcount(Computer) by IP, bin(TimeGenerated,1h)
| where Failures >= 20 and Accounts >= 5
| order by Failures descHunt 8: Windows privileged-account creation or group changes after suspected VPN access
Required telemetry: SecurityEvent account-management auditing; requires incident correlation
SecurityEvent
| where TimeGenerated >= ago(14d) and EventID in (4720,4728,4732,4756,4738)
| project TimeGenerated, Computer, Account, EventID, Activity, TargetAccount=tostring(column_ifexists("TargetUserName","")), EventData=tostring(column_ifexists("EventData",""))
| order by TimeGenerated descHunt 9: FortiBleed beacon relay and unusual outbound management ports
Required telemetry: CommonSecurityLog network flow; ports alone are weak signals
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DestinationPort in (4332,4432) or DestinationIP in ("45.154.12.132","45.155.250.158","85.11.187.8")
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceVendor, DeviceProduct, DeviceAction, DeviceName
| order by TimeGenerated descDetection Notes
**Highest signal:** unexpected FortiGate admin creation/deletion, privileged API-user changes, valid access from previously reported infrastructure, or a suspicious account change paired with new VPN access. **Noise:** vendor support accounts and legitimate administrator changes can overlap named indicators; IPs were observed primarily June–July 2026 and may have been reassigned. **Critical gaps:** many FortiGate connectors send logs to vendor-specific custom tables rather than CommonSecurityLog; event field mappings vary; VPN failure logs may omit normalized SourceUserName. SecurityEvent 4625 is a lateral-movement pivot, not proof of FortiBleed. Correlate with known firewall asset inventory and authorized change windows. No customer-specific Sentinel execution occurred.
