On October 7, 2026, the Federal Bureau of Investigation (FBI) and the U.S. Secret Service issued a joint alert warning that the FortiBleed campaign remains active, continuing to target internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. According to reports from The Hacker News and BleepingComputer, the campaign has compromised 86,644 devices across the globe.
The threat actors behind the operation are gaining initial access using credential stuffing, password spraying, infostealer logs, and reused or leaked login credentials. Once inside an exposed device, they extract authentication data and crack password hashes offline using distributed GPU clusters running Hashcat and Hashtopolis. In several cases, attackers created new administrator accounts and deleted or changed passwords on existing legitimate accounts, locking out business administrators entirely. The FBI noted that this intrusion chain has frequently served as an entry point for ransomware groups such as INC, Lynx, and Payload.
Why This Matters for Hawaii Businesses
Many local businesses across Oahu, Maui, Kauai, and Hawaii Island rely heavily on perimeter firewalls and legacy SSL VPN gateways. When staff work from home or connect branch locations across islands back to an on-premises database or server in Honolulu, that gateway is often left wide open to the public internet.
Because Hawaii companies often operate across islands, an appliance failure or an administrator lockout presents a major operational hurdle. If an attacker hijacks your gateway and locks you out of your management console, resolving the issue is not as simple as an off-island technician walking down the hall. A compromised firewall at the perimeter exposes internal file shares, accounting databases, and point-of-sale systems directly to ransomware operators.
How Gohoku Secures Island Networks Against Perimeter Hijacking
Remediating threats like FortiBleed requires moving away from fragile perimeter setups and securing how users connect. Gohoku helps local companies eliminate these exposures through practical, managed network safeguards.
Our Secure Remote Access service replaces vulnerable SSL VPN portals with hardened protocols like WireGuard, providing modern encryption and reliable access without exposing vulnerable administrative web logins to the public internet. Through our Network Management, our engineers audit edge hardware, enforce strong password hashing standards, and provide continuous monitoring to block automated spraying attacks. For broader protection, our Fully Managed IT Services maintain device firmware updates, enforce multi-factor authentication, and monitor systems for unauthorized account creation.
Reducing your attack surface also involves rethinking how remote staff communicate. Deploying our Kahevo Business Phone System allows neighbor-island staff and remote employees to manage calls and collaborate from anywhere using their local 808 numbers, removing the need to give broad VPN tunnel access to workers who only need office communication tools.
Practical Steps to Take This Week
If your office utilizes dedicated gateway appliances or VPN portals, here are steps you can review immediately with your technical team:
- Audit all exposed web management portals: Disable external internet access to administrator login pages on your firewalls and gateways so management interfaces cannot be reached publicly.
- Review local administrator accounts: Check your gateway user tables for unexpected accounts, unauthorized permission changes, or recently modified administrative credentials.
- Strengthen password hashing: The FBI explicitly recommends enforcing PBKDF2 for administrator password storage rather than relying on legacy SHA-256 hashes that attackers can crack offline with modern GPUs.
- Enforce multi-factor authentication (MFA): Ensure MFA is strictly enforced on all remote access logins, and terminate any dormant or legacy VPN user profiles that are no longer active.
- Evaluate legacy SSL VPN appliances: Review whether legacy SSL VPN connections into your central network can be replaced by modern, hardened point-to-point connections.
If you want a thorough audit of your perimeter hardware or want to modernize your remote access setup, reach out through our contact page to speak with our local team in Honolulu.
