Fortinet Responds to FortiBleed Campaign - SecurityWeek
My Extracts 2026-06-22 10:09:21
Context: Fortinet, a cybersecurity company, has responded to a large-scale credential-harvesting campaign, dubbed FortiBleed, that has targeted its customers' firewalls and VPNs. The campaign, which has compiled a database of over 86,000 confirmed working credentials for Fortinet devices in 194 countries, does not exploit new vulnerabilities but rather reuses credentials from previous incidents and employs brute-force techniques against devices with weak password hygiene. Fortinet has identified the potentially compromised systems, notified impacted customers, and is working with law enforcement to investigate the attacks.
Key Facts
- Fortinet has confirmed that the FortiBleed campaign, which has targeted its customers' firewalls and VPNs, does not exploit new vulnerabilities but rather reuses credentials from previous incidents and employs brute-force techniques against devices with weak password hygiene and no multi-factor authentication (MFA).
- The campaign has compiled a database of over 86,000 confirmed working credentials for Fortinet devices in 194 countries, leveraging techniques not related to any recent incident or advisory, according to Fortinet.
- Fortinet previously warned of threat actors' use of AI to automate target identification and password spraying in large-scale attacks targeting poorly protected edge devices, and the FortiBleed campaign employs similar techniques.