On 28 October 2026, Hong Kong's national Computer Emergency Response Team Coordination Centre (HKCERT) issued an alert on "FortiBleed 2.0," a newly surfaced set of stolen Fortinet FortiGate firewall configuration files. HKCERT advises owners who already checked their devices after the original FortiBleed disclosure in June to check again, because the new set includes devices that were not in the first list. Three weeks earlier, on 6 October, the Federal Bureau of Investigation (FBI) and the U.S. Secret Service published a joint advisory warning that the FortiBleed campaign is still active, that some owners have been locked out of their own firewalls, and that ransomware affiliates are using it as a way in. That advisory lists water, energy, chemical, dams, nuclear and critical manufacturing among the sectors it applies to.
What FortiBleed is. FortiBleed is a credential campaign against internet-facing FortiGate firewalls and secure sockets layer (SSL) virtual private network (VPN) gateways, the devices that sit at the edge of many plants and remote sites. Fortinet's product security team says it is not a new vulnerability. According to Fortinet, attackers reused credentials stolen in earlier incidents, including the exploited FortiCloud single sign-on (SSO) login bypass CVE-2026-24858 from January 2026, and guessed weak passwords on devices without multifactor authentication (MFA). The Cybersecurity and Infrastructure Security Agency (CISA) warned in June that leaked credentials for about 74,000 Fortinet devices were involved, and added CVE-2026-24858 to its Known Exploited Vulnerabilities catalog in January.
What is new in FortiBleed 2.0. According to the research behind the alert, published by Hudson Rock on 27 October, the new material is about 1,700 parsed configuration files, nearly all dated 20 February 2026. They hold more than 100,000 account records, including about 37,000 local and VPN user passwords in readable form, about 1,600 readable Active Directory service account (LDAP bind) passwords, and admin, email server and high-availability cluster secrets. More than half of the devices were not in the first FortiBleed list. HKCERT stresses that this is older material obtained recently, not a new wave of attacks, and that record counts are not counts of logins that still work.
Why a configuration file matters more than a password list. A firewall configuration is a map of how the site connects. It holds the VPN users operators and vendors log in with, the service account the firewall uses to check those logins against Active Directory, and addresses of internal servers. Older FortiOS settings that use the factory default encryption key let stored secrets be recovered offline from a stolen file.
Where this shows up from the plant floor to the cloud. At remote pump stations, lift stations, substations and well pads, a small FortiGate is often the only thing between a cellular or broadband link and the control network. At the plant, the FortiGate that terminates vendor remote access is a direct path toward the control room. If the firewall checks logins against an Active Directory domain that the business and control system sides share, a stolen service account password can be used well beyond the firewall. In the cloud, devices registered under a managed service provider (MSP) or integrator's account may not be recognized as yours when you search for exposure.
What it means for OT owners. If your firewall was in either batch, changing the admin password alone is not enough. Every secret stored on the device should be treated as known to the attacker, and the accounts it connects to should be watched.
What the Red Tiger team recommends:
Owners can also check their domains against the FortiBleed lists using Hudson Rock's free lookup at hudsonrock.com/fortinet. Because firewalls are often registered under a provider's email, a clean result is not proof of a clean device.
With 500+ assessments across critical infrastructure, the Red Tiger Security team helps owners review edge firewalls and remote access paths into OT with plant-safe methods, and sets up 24x7 monitoring that can spot misuse of trusted accounts.
Read the full advisory: https://www.redtigersecurity.com/advisory/fortibleed-2-0
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Sources:
FBI and U.S. Secret Service, "FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts," JCSA-20261006-01, 6 October 2026: https://www.ic3.gov/CSA/2026/261006.pdf
HKCERT, "FortiBleed 2.0 Reveals Additional FortiGate Configuration and Credential Exposure," 28 October 2026: https://www.hkcert.org/security-bulletin/security-alert-fortibleed-2-0-reveals-additional-fortigate-configuration-and-credential-exposure_20261028
Fortinet PSIRT, "Analysis of Reported Credential Compromise of FortiGate Devices," 19 June 2026: https://www.fortinet.com/blog/psirt-blogs/analysis-of-reported-credential-compromise-of-fortigate-devices
CISA, "CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure," 18 June 2026: https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-urges-hardening-fortinet-devices-after-reports-credential-exposure
CISA, CVE-2026-24858 alert, 28 January 2026: https://www.cisa.gov/news-events/alerts/2026/01/28/fortinet-releases-guidance-address-ongoing-exploitation-authentication-bypass-vulnerability-cve-2026
Supporting research: Hudson Rock (InfoStealers), "FortiBleed 2.0," 27 October 2026: https://www.infostealers.com/article/fortibleed-2-0-975-new-domains-40573-exposed-secrets-claim-your-ethical-disclosure/
Check out our resources and book a follow-up call with our team.
