The Cyber Security Authority (CSA) has issued an urgent advisory warning organisations across Ghana about a large-scale cybercrime campaign known as “FortiBleed,” which is actively targeting Fortinet FortiGate firewalls and Secure Socket Layer (SSL) Virtual Private Network (VPN) gateways.
In the advisory released on June 19, 2026, the Authority cautioned that organisations relying on Fortinet security devices face significant risks, particularly where weak passwords, password reuse and inadequate authentication controls remain in place.
According to the CSA, the FortiBleed campaign is not exploiting a newly discovered software flaw. Instead, attackers are taking advantage of poor cybersecurity practices, including compromised credentials and the absence of multi-factor authentication (MFA).
Automated Credential Attacks
The Authority explained that cybercriminals behind the campaign are conducting automated scans of internet-facing Fortinet devices and testing them against extensive databases of leaked usernames and passwords.
“Valid credentials are catalogued and reused, enabling attackers to access systems at scale across multiple sectors,” the advisory stated.
The CSA warned that once attackers gain access, they can monitor network traffic, harvest authentication data and establish persistent access to compromised systems.
It further noted that successful intrusions could lead to privilege escalation, lateral movement across networks and the compromise of critical systems, including Active Directory environments that underpin many organisational IT infrastructures.
Organisations Most at Risk
The Authority identified several factors that increase vulnerability to the FortiBleed campaign, including publicly accessible administrative or VPN interfaces, weak or reused passwords, failure to enforce multi-factor authentication for administrators and unrestricted access to management systems from untrusted internet sources.
Government institutions, financial institutions, telecommunications providers, educational establishments, healthcare facilities and other operators of critical digital infrastructure have been urged to take immediate precautions.
Signs of Possible Compromise
To help organisations detect potential breaches, the CSA outlined several warning signs that require urgent investigation.
These include login attempts from unusual locations or at unusual times, repeated failed login attempts followed by successful access, the creation of unknown administrator accounts, unexplained changes to firewall configurations and suspicious outbound connections to unfamiliar internet addresses.
According to the Authority, the presence of any of these indicators may signal an attempted or successful compromise and should trigger immediate incident response measures.
Immediate Security Measures Recommended
As part of its mitigation strategy, the CSA has advised organisations to immediately change all administrative and VPN credentials, enforce multi-factor authentication and ensure the use of strong, unique passwords.
Additional recommendations include restricting access to administrative interfaces through trusted IP addresses or internal networks, disabling unnecessary services and unsecured management interfaces and continuously monitoring firewall, VPN and authentication logs for suspicious activity.
The Authority also encouraged organisations to implement network segmentation and least-privilege access controls to limit the impact of any successful intrusion.
Furthermore, all Fortinet devices should be updated with the latest firmware and security configurations in line with vendor recommendations.
To assist organisations in evaluating their exposure, the CSA advised conducting vulnerability assessments using publicly available cybersecurity assessment tools.
Rising Global Cybersecurity Threats
The latest advisory comes amid growing concerns about the increasing sophistication of cyberattacks targeting organisations worldwide.
Cybersecurity experts have consistently warned that threat actors are increasingly relying on stolen credentials and weak security practices rather than solely exploiting software vulnerabilities.
In recent years, the CSA has intensified public awareness campaigns and regulatory interventions aimed at strengthening Ghana’s cyber resilience, particularly among operators of Critical Information Infrastructure (CII).
The Authority reiterated its commitment to supporting organisations affected by cybersecurity incidents and urged entities that detect suspicious activity linked to the FortiBleed campaign to immediately report the matter through its 24-hour Cybersecurity and Cybercrime Incident Reporting Point of Contact.
