FBI says FortiBleed is still locking admins out. The ISO is not the close.

JCSA-20261006-01 is credential reuse and SHA-256 hashes, not a new CVE. INC/Lynx and Payload sit downstream. This is not FortiMail.

RWP Ventures · 2026-10-08 · event 2026-10-06 · 14 min read · priority 8.9

This is not a new CVE and not a new KEV row. CISA’s catalog freeze is still 2026.10.04, count 1734, last add CVE-2026-88779. FortiBleed is credential reuse, stuffing, spraying, and offline cracking of legacy SHA-256 administrator hashes. Fortinet’s June PSIRT blog already said the same class: credentials from prior incidents (FG-IR-26-060, FG-IR-25-647) plus brute force against boxes with weak passwords and no MFA. CISA’s 18 June alert (updated 22 June) already told FCEB to terminate sessions, reset passwords, and enforce PBKDF2. The 6 October CSA is the lockout-and-ransomware update, not a firmware 0-day.

Do not collapse four facts.

1. The ISO is not the eviction. A current FortiOS build does not remove an admin the actor already created, does not restore an admin the actor deleted, and does not rotate a hash that was already cracked. FBI/USSS: some victims cannot log in because the original accounts were disabled or the passwords were changed (T1531). Patching without hunting is how you keep a broker’s VPN config.
2. This is not FortiMail. [CVE-2026-104286](/posts/2026-10-02-fortimail-cve-2026-104286-kev/) is unauthenticated path traversal on the mail gateway, KEV 1 October, due 4 October. FortiBleed is FortiGate / SSL VPN credentials. Do not brief one Fortinet ticket.
3. 86,644 is a SOCRadar figure the agencies repeated. It is not an FBI census. Treat the scale as REPORTED, the campaign as CONFIRMED, the lockout behavior as CONFIRMED from victim response, and the ransomware hand-off as REPORTED by the agencies (“reporting indicates”).
4. A FortiGate in front of a plant is still an IT edge compromise until someone shows process impact. The CSA’s audience is all 16 U.S. critical-infrastructure sectors. That is who runs these boxes. It is not evidence of a PLC write.

What happened

June 2026: a credential set tied to tens of thousands of FortiGate URLs landed in public reporting. CISA told operators to kill sessions, reset passwords, turn on MFA, and move administrator storage off legacy SHA-256. Fortinet’s 19 June PSIRT note framed the activity as reuse of older incident credentials and brute force, not as a fresh remote-code bug.

6 October: FBI and USSS put a TLP:CLEAR joint CSA on IC3. The new operational facts are lockouts, a published hunting list, and an explicit ransomware sentence. The actors are still scanning exposed SSL VPN portals with credentials they already hold. After login they create new local admins, and in some cases they delete or reset the accounts the owner still thinks they have. They enumerate Active Directory. They package working VPN configurations. The agencies describe an initial-access broker, not a single ransomware brand owning the scanner.

The backend that made the workflow visible was the operators’ own open directory — scanning scripts, a GPU cracking cluster running Hashcat under Hashtopolis, honeypot filters, and target lists sorted by revenue. That exposure is how the campaign got a public name. It is not a claim the campaign stopped.

BleepingComputer reported the CSA on 7 October (17:28). Yesterday’s Daily Top was the Hitachi RTU500 ICS republication. This CSA was not on that ticket.

Why it matters

FortiGate SSL VPN is the box that terminates staff remote access and often sits in front of identity, mail, and jump hosts. Valid VPN or admin credentials on that box are not “a reused password.” They are a path onto the management plane of the firewall that writes the rest of the policy.

Three operational lies are now in the ticket.

1. “We patched FortiOS in July, so FortiBleed is closed.” Incomplete. The June/July work was session kill, password reset, MFA, and PBKDF2. If those were skipped, or if only the default admin was rotated, the 6 October CSA is describing the residue: leftover SHA-256 hashes, leftover VPN users, leftover REST API keys, and leftover internet-facing GUI/SSH. A later firmware bump does not invent MFA that was never enabled.
2. “No CVE means no incident.” The agencies are not asking you to apply a PSIRT ISO for this CSA. They are asking you to assume the credential set is still being tried against whatever is still reachable. The lockout reports are the evidence that some of those tries are still succeeding.
3. “We will reset passwords after we confirm compromise.” If the actor already changed the admin password, you confirm compromise by being unable to log in. FBI/USSS: remediation may require more than patching and resetting Fortinet passwords. Out-of-band access, serial, local console, or Fortinet support — plan that before you need it.

A water or energy operator whose FortiGate is the WAN edge has an IT firewall problem until logs show a process write. None are in this CSA.

Who / what is affected

Technical context

RWP is not reproducing stuffing wordlists, FortiOS hash-extraction commands, or a cracking recipe. The defender cut in the CSA is enough.

Access path. Scan internet-facing SSL VPN portals (T1595, T1190). Authenticate with leaked or stuffed passwords (T1110.004, T1110.003). Dump additional FortiOS user-database material and session artifacts (T1003). Ship hashes to a GPU cluster (Hashcat / Hashtopolis, T1110.002). Create a new local admin (T1136.001). Optionally lock the real admins out (T1531). Enumerate AD (T1087). Sell the VPN config.

Hash class. Fortinet moved administrator password storage from SHA-256 to PBKDF2 starting FortiOS v7.2.11, 7.4.8, and 7.6.1. In config, ENC SH2… is the old hash. ENC PB2… is PBKDF2. Upgrade does not rewrite every admin hash. Fortinet’s own tip: an account stays SH2 until that administrator logs in on the new firmware, or until you force the conversion. set login-lockout-upon-weaker-encryption is the published enforcement, not a rumor.

Persistence the CSA actually named. New local admins. Unexpected REST API keys. SSH if that port was open. Common account names from victim systems (hunt list, not a blocklist of people): adminin, fortiAdmin, forticloud-sync, fgtsecure, pakedge, forticloud-tech, districtadmin, system_config, gttadmin, roadmin, itadmin, Technical_support, adminsslvpn, IT_Manager, my_admin, support_fortinet, fgtsec, forti_support2. admin is on the same table; treat it as “was this default still valid,” not as “every admin account is malicious.”

Infrastructure the CSA printed for log review. C2 example 45.154.12.132. Proxy nodes 154.202.59.169, 103.27.186.156. Beacon relay 45.155.250.158. Ports 4332 and 4432, usually over HTTPS. Hashtopolis-related 85.11.187.8, plus 193.8.187.2 and 193.8.187.42. A separate table of brute-force / successful-auth IPs with June–July 2026 observation windows (104.28.155.27, 185.136.15.43, 185.136.15.66, 185.199.199.56, 193.8.186.33, 45.227.254.210, 77.91.118.10, 80.75.212.113, 87.251.64.13, 87.251.64.16, 87.251.64.17, 87.251.64.44, 66.175.220.111). The agencies’ own caveat: cloud and VPS addresses get reassigned. A hit is a lead. A CIDR block of 2026-06 dates is not a 2026-10 firewall policy.

ATT&CK mapping from the CSA, not a kill chain we ran:

Threat / exploitation status

Confidence on the CSA, the lockout behavior, the hash-class problem, and the KEV freeze: high. Confidence on the 86,644 figure as a current live-compromised count: low (third-party, June-era, not re-verified here). Confidence that every internet-facing FortiGate without MFA is already owned: low. Confidence of in-the-wild use of the campaign: high.

What defenders should do

1. Inventory every FortiGate that answers on SSL VPN or an admin GUI from an untrusted network. Include HA peers, DR, MSSP-managed, and the “temporary” box in a plant DMZ. If you cannot list them, you cannot hunt them.
2. Get an out-of-band path before you reset anything. Serial, local console, Fortinet support, or a jump host that does not depend on the SSL VPN you are about to kill. Lockout is the failure mode the CSA is documenting.
3. Terminate all admin and VPN sessions. Reset all Fortinet VPN and administrative passwords. Require phishing-resistant MFA on both. That is the CSA’s order, and it is the June CISA order restated. Do it even if you “already patched.”
4. Confirm PBKDF2, do not assume the upgrade did it. On 7.2.11+ / 7.4.8+ / 7.6.1+, every admin should show PB2, not SH2. Force remaining SH2 accounts through login or the published lockout-on-weaker-encryption path. Fortinet’s June note still wants latest 7.4 / 7.6 / 8.0 for that class.
5. Hunt the box as if a broker already had a shell equivalent. Diff running config against known-good. Look for the account names above, any admin you did not create, unexpected trustedhost changes, new REST API keys (refresh the legitimate ones), SSH enabled on WAN, and local-in policy holes. Pull logs for the CSA IPs and for successful SSL VPN / admin logins you cannot explain. A June IP in a 2026-10 log is a lead; absence of those IPs is not a clean bill.
6. If you are locked out or you find a planted admin: isolate WAN management, freeze policy changes, rotate downstream. LDAP/RADIUS secrets the FortiGate holds, VPN user passwords, API keys, and any trust AD placed in that gateway. Rebuild from known-good firmware and config; do not “delete the extra admin” and return the box to SSL VPN duty.
7. Pull management off the internet. Trusted hosts (minimum), local-in policy (better), no public admin at all (the CSA’s “best”). That is exposure reduction, not a substitute for the hunt.
8. Keep the rest of this window on the board. NetScaler CVE-2026-88779 was KEV, due yesterday, 7 October — [5 October ticket](/posts/2026-10-05-netscaler-cve-2026-88779-kev/). FortiMail CVE-2026-104286 is a different Fortinet appliance. Atlassian CVE-2026-21589 had honeypot exploitation reported 7 October, a day after [our Data Center assessment](/posts/2026-10-06-atlassian-cve-2026-21589-file-access/). Splunk CVE-2026-76268 (Patroni REST, 9.8, search-head cluster 10.4.x / 10.2.x) and SonicWall SMA1000 CVE-2026-102255 (pre-auth SSRF, 10.0, no claimed in-the-wild) are real, unexploited-as-published tickets. They are not this campaign.

RWP assessment

Highest-leverage new development since [yesterday’s Hitachi RTU500 Daily Top](/posts/2026-10-07-hitachi-rtu500-cve-2026-8065-eol/) is not a CVE. It is a joint FBI/USSS CSA that says a four-month credential campaign against the most common enterprise firewall VPN is still converting access into lockouts and ransomware hand-offs. Evidence quality is high on the CSA and on Fortinet’s earlier hash-class guidance. Exploitation evidence is high for the campaign, low for any single new bug. Device-count confidence is intentionally lower than campaign-existence confidence.

It outranks Atlassian CVE-2026-21589 honeypot hits because that CVE was the 6 October Daily Top; Previdian’s 7 October sensor traffic is a material follow-on, not a new product class, and it is still recon-scale. It outranks Splunk CVE-2026-76268 because 9.8 unauthenticated command execution on a Patroni sidecar is a real search-head-cluster bug with no claimed exploitation and a disable-postgres workaround. It outranks SonicWall SMA1000 CVE-2026-102255 because SonicWall says none of the four bugs in SNWLID-2026-0017 are known in the wild. It outranks Cisco APIC’s 7 October hardening dump (CVE-2026-76498/76499/76500) because those are internally found CWE buckets with PSIRT “not aware of malicious use.” It outranks a new KEV hunt because there is no new KEV row this freeze. It outranks a second FortiMail day because 104286 is still the mail-gateway KEV, not FortiGate.

What we are not saying: that FortiBleed is a 2026 FortiOS 0-day; that 86,644 boxes are confirmed still compromised this morning; that INC/Lynx or Payload wrote the scanner; that a FortiGate in front of a substation is confirmed OT impact; that this CSA replaces FortiMail CVE-2026-104286.

Confidence on the advisory, the lockout reports, the PBKDF2/SHA-256 split, and the KEV freeze: high. Confidence on current live-compromised inventory: low. Confidence of ongoing use: high.

What we are watching

• Whether CISA republishes JCSA-20261006-01 as a KEV-adjacent alert, or names a CVE if a fresh FortiOS bug is later tied to the same access.
• Whether Fortinet updates the June PSIRT blog with lockout-specific recovery steps.
• INC/Lynx and Payload victim reporting that cites FortiGate SSL VPN as the beachhead — still REPORTED, not a victim table.
• Atlassian CVE-2026-21589 moving from honeypot probes to KEV.
• Splunk CVE-2026-76268 scan telemetry against Patroni on search-head clusters.
• SonicWall SMA1000 CVE-2026-102255 given that family’s 2026 ransomware history.
• Catalog freeze leaving 2026.10.04 / 1734.

Sources

• FBI / USSS — JCSA-20261006-01 (PDF)
• FBI IC3 — Cybersecurity Advisories
• CISA — Fortinet credential exposure alert, 18/22 June 2026
• Fortinet — Analysis of reported FortiGate credential compromise
• Fortinet — Enforcing PBKDF2 for administrator accounts
• Fortinet — FG-IR-26-175 FortiMail
• SOCRadar — FortiBleed device count
• BleepingComputer — FBI FortiBleed lockouts, 7 October 2026
• CISA — KEV JSON catalog 2026.10.04
• CISA — Known Exploited Vulnerabilities Catalog
• CSA Singapore — AD-2026-007
• [RWP — FortiMail 104286 KEV Daily Top, 2 October 2026](/posts/2026-10-02-fortimail-cve-2026-104286-kev/)
• [RWP — Hitachi RTU500 Daily Top, 7 October 2026](/posts/2026-10-07-hitachi-rtu500-cve-2026-8065-eol/)
• [RWP — Atlassian 21589 Daily Top, 6 October 2026](/posts/2026-10-06-atlassian-cve-2026-21589-file-access/)
• [RWP — NetScaler 88779 KEV Daily Top, 5 October 2026](/posts/2026-10-05-netscaler-cve-2026-88779-kev/)