A large-scale credential-harvesting campaign tracked as FortiBleed has compromised over 430,000 internet-facing FortiGate firewalls globally, yielding more than 110 million credentials from a sprawling initial access operation active since February 2026. The campaign, attributed to a Russian-speaking initial access broker (IAB) motivated by financial gain, combines mass scanning, brute-force attacks, and custom passive sniffers deployed on compromised appliances to extract cleartext and hashed authentication data from network traffic.
The Scale and Reach of the FortiBleed Campaign
The operation centers on a Golang-based tool called FortigateSniffer, which leverages a built-in FortiOS diagnostic command — diagnose sniffer packet — to passively capture authentication traffic from infected firewalls. Available in both Windows and Unix variants, the sniffer monitors traffic across 24 protocols, parses authentication data, and extracts credentials without requiring exploitation of any new vulnerability. The attackers also employed an open-source, AI-native offensive security framework known as CyberStrike to support parts of the workflow, and researchers identified a specific binary identifying itself as CyberStrike Harvester v1.5 used for processing captured data.
Between May 31 and June 15, 2026, the threat actors launched no fewer than 659 credential-harvesting pipelines. The haul includes 14.8 million RADIUS credentials, 924,000 NTLM hashes, 130,000 Kerberos hashes, and 89 million MySQL authentication tokens. The campaign exhibits a heavy focus on small and medium businesses with fewer than 200 employees, with the IT services sector emerging as a primary target — likely to maximize downstream access into customer environments through compromised service providers.
Anatomy of the Five-Stage Attack Chain
The FortiBleed operation unfolds across five distinct stages, each designed to progressively deepen access and expand credential collection.
Stage 1: Reconnaissance and Targeting. The attackers perform widespread internet scanning using tools such as Masscan and Shodan to identify vulnerable, internet-facing FortiGate firewalls. A custom utility called FortiProbe-fast filters for FortiGate systems, while GeoSplit groups targets by country for geographically targeted operations.
Stage 2: Compromise and Initial Access. A credential checker named “forticheck” specifically targets FortiGate administrative panels and SSL-VPN portals. Additional tools obtain administrative SSH access through credential stuffing and dictionary attacks against devices with weak or reused passwords.
Stage 3: Passive Credential Harvesting. Once SSH access is established, the actors deploy FortigateSniffer to passively intercept authentication traffic across protocols including TACACS+, Kerberos, RPC, SMB, LDAP, SMTP, FTP, Telnet, RDP, WinRM, MS-SQL, MySQL, PostgreSQL, and RADIUS. The tool uses native FortiOS diagnostic commands, making detection difficult and allowing capture of both cleartext credentials and password hashes.
Stage 4: Hash Cracking and Validation. Captured password hashes are cracked using Hashcat and Hashtopolis, orchestrated through a Telegram bot named HASHBOT. The bot accepts hash input, restricts access by Telegram username, detects hash modes, schedules jobs, allocates GPUs, and returns cracked results. Cracked credentials then feed into Active Directory enumeration, Kerberos validation, SMB authentication, and lateral movement.
Stage 5: Exfiltration and Persistence. Sensitive data from network shares is exfiltrated, while stolen session cookies maintain persistent authenticated access. The attackers do not treat all targets equally — targets are ranked according to estimated economic value before exploitation resources are allocated.
Multi-Vendor Expansion Beyond Fortinet
Perhaps the most concerning finding is that FortiBleed is part of a broader, multi-vendor initial access operation. Since February 28, 2026, the same infrastructure has also targeted Synology NAS appliances, Sophos firewalls, RDWeb portals, Citrix SSL-VPNs, and MS-SQL servers using automated brute-forcing. SpyCloud researchers noted the threat actor group was “not just targeting FortiGate VPNs” but conducting a standard spray-and-pray attack chain relying on mass scanning and login brute-forcing across a range of internet-facing appliances.
Operational Security and Geofencing
The sniffing mechanism includes a geofencing filter that restricts operations to specific IP ranges, and the actors limit credential-harvesting activity to between 7 a.m. and 6 p.m. Moscow Time. The operation runs in 300-minute (five-hour) cycles, with status updates every minute. In each cycle, a regional target list is loaded and validated using 1,000 simultaneous threads. During early cycles, successful validation rates reportedly hovered near 90 percent.
Analysis of the attacker’s own validated-credentials file revealed certain username and password pairs repeated across thousands of distinct IP addresses — for example, the credentials “adminin:ITAdmin@888” appeared on 3,947 distinct devices. Researchers assess these may be planted accounts rather than organic credentials, based on three factors: the same credentials validated across thousands of unrelated organizations, the absence of passwords from some credential source files, and usernames that mimic legitimate Fortinet and FortiCloud services to blend into targeted environments.
No Zero-Day Exploited — Weak Passwords and Missing MFA Are the Entry Point
A critical detail that organizations should note: the attacks do not exploit any new zero-day vulnerability. Fortinet confirmed that threat actors are likely reusing credentials from previous breaches and brute-forcing passwords on devices with weak passwords that have not had multi-factor authentication (MFA) enabled. The defining characteristic of FortiBleed is a credential feedback loop — successful perimeter access creates configuration or traffic artifacts, those artifacts produce more credentials and crackable hashes, and cracked credentials feed into VPN, Kerberos, SMB, and share-access validation for further collection and exfiltration.
What Is FortiBleed and Why Does It Matter?
FortiBleed is a credential-harvesting operation targeting FortiGate firewalls that uses passive sniffing, brute-forcing, and hash cracking to extract over 110 million credentials from more than 430,000 devices. It matters because it demonstrates how exposed perimeter credentials can lead directly to full internal-network compromise, and because the attackers have engineered a repeatable, automated pipeline that converts initial access into a continuous stream of actionable credentials and downstream access. The operation does not rely on sophisticated exploits — it preys on weak passwords, missing MFA, and unpatched configurations that remain prevalent across organizations of all sizes.
Underground Market Activity and Access Sales
A Russian-speaking account named “SantaAd” has advertised access to thousands of Fortinet devices, starting at $30,000 before increasing the price to $60,000 hours later. While direct connection to the FortiBleed exposure remains unclear, the timing and scale suggest a thriving underground market for compromised perimeter access. CloudSEK researchers noted that the toolchain feeds a revenue-sorted catalog of remote access targets likely destined for sale on underground markets, and the directory contained at least one live SSL VPN configuration file pointing into a victim network — confirming that operators held usable, active access, not merely a list of cracked passwords.
What Affected Organizations Should Do Now
Organizations using FortiGate firewalls should treat this campaign as an active threat requiring immediate action. Rotate all administrative and VPN credentials, invalidate active sessions, and audit configuration exports for unauthorized changes. Review SSL-VPN login logs for anomalous activity and inspect Active Directory and SMB activity originating from VPN address pools. Scan for outbound SSH transfer patterns that may indicate data exfiltration, and review SMB share access logs for bulk recursive reads that suggest unauthorized collection. Enable multi-factor authentication on all administrative interfaces and VPN portals without exception. If your organization lacks the in-house capability to perform these checks, engage a reputable incident response provider with experience in perimeter compromise investigations. Consider deploying a zero-trust network access architecture that limits lateral movement even if perimeter credentials are compromised — because the credential feedback loop at the heart of FortiBleed means one weak password can cascade into full network exposure.
