FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation
FortiBleed operation harvests 110 million credentials from FortiGate firewalls.
A Russian-speaking initial access broker is behind the FortiBleed operation, targeting over 430,000 FortiGate firewalls globally since February 2026. The campaign harvests credentials using a Golang-based tool called FortigateSniffer, which exploits FortiOS diagnostic commands to capture authentication traffic. The operation has collected over 110 million credentials, including RADIUS, NTLM, Kerberos, and MySQL tokens, and appears to be part of a broader multi-vendor initial access campaign.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Fortinet?
Get an email when a new story names Fortinet, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe FortiBleed operation demonstrates the catastrophic consequences of failing to patch internet-facing network appliances in a timely manner. A Russian-speaking initial access broker exploited diagnostic command functionality in FortiOS to passively harvest over 110 million credentials — including RADIUS, NTLM, and Kerberos tokens — across more than 430,000 exposed FortiGate devices. The sheer scale of credential theft means compromised organizations face cascading lateral movement risk across their entire infrastructure. This campaign underscores that perimeter security devices are high-value targets precisely because they sit at the trust boundary, making unpatched vulnerabilities in firewalls uniquely dangerous compared to typical endpoint exposures.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — FortigateSniffer
- malware — FortiProbe-fast
- malware — forticheck
- malware — HASHBOT