FortiBleed: Fortinet firewall alert in Colombia

A global campaign uses stolen passwords to take over FortiGate firewalls and VPNs. The FBI issued an alert and an analysis by Hudson Rock places Colombia among the hardest-hit countries.

On October 6, 2026, the FBI and the U.S. Secret Service published a joint alert about FortiBleed, an active worldwide campaign against internet-exposed Fortinet FortiGate firewalls and SSL VPN gateways. The firm SOCRadar, cited in the alert, verified more than 86,644 compromised devices in 194 countries, and an analysis by the firm Hudson Rock places Colombia among the hardest hit.

This is not a flaw in Fortinet's code: the attackers get in with stolen or weak credentials. That is why updating the firmware is not enough if the passwords are already in the hands of third parties.

How the campaign works

They mass-test usernames and passwords from previous Fortinet leaks and from the logs of credential-stealing malware.
They crack the password hashes they obtain offline, using graphics card farms, and take advantage of devices that still store them in the old SHA-256 format.
Once inside, they create new administrator accounts and explore the company's Active Directory.
They sell that access to ransomware groups: the alert mentions INC/Lynx and Payload affiliates.
In some cases they delete or change the original accounts and lock the legitimate administrator out of their own firewall.

What is happening in Colombia?

According to the analysis by the firm Hudson Rock, Colombia ranks seventh worldwide, with 2,436 compromised Fortinet devices. The FBI alert does not mention countries. A figure of 27 affected Colombian organizations, attributed to a ColCERT alert, has circulated in the media, but we could not find that alert published, so we do not treat it as confirmed.

Signs that your firewall was compromised

The FBI alert includes indicators of compromise. Among them are administrator accounts that nobody created, with names such as fortiAdmin, forticloud-sync, adminsslvpn or support_fortinet, as well as unknown API keys or configuration changes.

What to do if your company uses Fortinet

Remove internet access to the management interface. Ideally, eliminate it completely; if that is not possible, restrict it with a local policy or to trusted addresses.
Close all active management and VPN sessions, and change all administrator and VPN user passwords.
Require phishing-resistant two-factor authentication for the VPN and for management.
Compare accounts, configuration and API keys against a known copy and remove anything you don't recognize.
Update FortiOS and verify that administrator passwords are stored with PBKDF2 (FortiOS 7.2.11 or later). Then ask each administrator to log in again so their password is stored in the new format.

October 31 update: the Colombia figure

We checked this article against the FBI alert and the SOCRadar and Hudson Rock analyses. Colombia's seventh place, with 2,436 devices, comes from Hudson Rock. We removed the attribution to a ColCERT alert and the figure of 27 organizations, because only a media outlet had published them.

How we help you

We review your firewall's exposure, harden the VPN and keep management off the internet as part of our secure business networks service. If you suspect your device was compromised, request an urgent review.