FortiBleed Campaign Hits 86,644 FortiGate Boxes; CISA Pushes Customers to Lock Down
Russian-speaking operators are working through internet-exposed Fortinet appliances at scale. CISA wants admins moving now.
The U.S. Cybersecurity and Infrastructure Security Agency has told Fortinet customers running FortiGate appliances to act against an active campaign hitting tens of thousands of internet-facing devices.
The operation has a name: FortiBleed.
Investigators attribute it to Russian-speaking threat actors. The compromise count sits at 86,644 FortiGate devices reachable from the public internet, a figure that puts this firmly in the category of campaigns where the question is not whether an exposed box has been touched, but when.
CISA issued the advisory Thursday. The agency framed the activity as ongoing, which matters: this is not a post-mortem on a closed incident but a live event with attackers still working through the target list.
What CISA has not done — at least in the public notice — is publish granular indicators tying FortiBleed to a specific CVE or a named Fortinet advisory. FortiGate appliances have absorbed a steady run of edge-device vulnerabilities over the past two years, several of which are still being mass-exploited months after patches shipped. Admins should assume any unpatched, internet-reachable FortiGate is in scope until proven otherwise.
The scale also tells you something about the underlying problem. Edge appliances sit at the front door, terminate VPN sessions, and broker access to everything behind them. When one falls, the blast radius is the network. An 86,644-device footprint means a meaningful slice of corporate VPN concentrators, branch firewalls, and remote-access gateways are potentially serving an adversary's interests right now.
Jurisdiction here is split. CISA leads the U.S. federal response and can compel action on federal civilian networks via Binding Operational Directives. Private-sector victims that hold personal data will answer to state attorneys general and, depending on the data categories, the FTC. Affected entities in the EU and UK fall under GDPR and UK GDPR notification clocks running to the relevant supervisory authority — 72 hours from awareness.
What FortiGate operators should do now:
- Pull every FortiGate appliance off the public internet that does not need to be there. Restrict management interfaces to known administrative IPs.
- Patch to the latest firmware track for your model and confirm against Fortinet's PSIRT advisories at fortiguard.fortinet.com/psirt.
- Rotate all local admin credentials, VPN pre-shared keys, and any certificates loaded on the device. Assume secrets on a compromised box are burned.
- Hunt for unauthorized admin accounts, unexpected config changes, new VPN tunnels, and outbound connections from the appliance itself. Review logs back to at least the start of the year.
If personal data traversed a compromised appliance, breach-notification obligations may already be running. Counsel should be looped in before the forensics report lands, not after.
