FortiBleed: 110M Credentials Harvested via Unpatched FortiGate Firewalls
Written by AI from the linked story. Not reviewed by an editor. How this works
The FortiBleed operation demonstrates the catastrophic consequences of failing to patch internet-facing network appliances in a timely manner. A Russian-speaking initial access broker exploited diagnostic command functionality in FortiOS to passively harvest over 110 million credentials — including RADIUS, NTLM, and Kerberos tokens — across more than 430,000 exposed FortiGate devices. The sheer scale of credential theft means compromised organizations face cascading lateral movement risk across their entire infrastructure. This campaign underscores that perimeter security devices are high-value targets precisely because they sit at the trust boundary, making unpatched vulnerabilities in firewalls uniquely dangerous compared to typical endpoint exposures.
Tactical Insight
Immediate Actions
- Apply the latest FortiOS patches or firmware updates to all FortiGate devices without delay, prioritizing internet-facing instances.
- Audit and rotate all credentials that may have transited FortiGate devices since February 2026, including RADIUS, NTLM, Kerberos, and database tokens.
- Restrict or disable unnecessary FortiOS diagnostic and CLI commands accessible via management interfaces.
Detection Measures
- Deploy network-based monitoring to detect anomalous authentication traffic patterns or unexpected use of FortiOS diagnostic APIs.
- Threat-hunt for indicators of compromise associated with the FortigateSniffer Golang-based tool across firewall logs and network telemetry.
- Enable centralized SIEM ingestion of FortiGate logs to identify credential harvesting behavior in near real-time.
Long-Term Improvements
- Enforce a strict patch SLA (e.g., 72 hours) for critical vulnerabilities on all internet-facing network appliances and enforce it via automated compliance checks.
- Implement out-of-band, dedicated management networks for all firewall and network appliance administration to reduce exposure of diagnostic interfaces.
- Adopt a Zero Trust architecture to limit the blast radius if perimeter device credentials are compromised, ensuring stolen tokens cannot enable unrestricted lateral movement.