FortiBleed Campaign: Mass FortiGate SSL VPN / Admin Credential Exposure Affecting ~73,932 Fortinet Firewalls Across 194 Countries
FortiBleed Campaign (TL-2026-0868), also tracked as FortiBleed, is a critical-severity data breach, first published 2026-06-13. It has no confirmed attribution, affects Fortinet FortiGate / FortiOS (SSL VPN and administrative interface), references 2 CVEs (CVE-2018-13379, CVE-2022-40684), maps to 23 MITRE ATT&CK techniques (T1003, T1005, T1018), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-0868
- Threat ID
- TL-2026-0868
- Also known as
- FortiBleed, FortiBleed Campaign, FortiBleed leak
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- 2026-06-13
- Last reviewed
- 2026-06-13
- Attribution confidence
- NONE
- Motivation
- ESPIONAGE
- Target sectors
- government, telecommunications, financial services, healthcare, manufacturing, critical infrastructure, defense, IT services, education, energy
- Target regions
- Global (194 countries), North America, Europe, Asia, Middle East, Latin America
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in FortiBleed Campaign
Malware and tooling: 45-GPU Hashtopolis cracking cluster, Hashcat, Hashtopolis
A Russian-speaking, multi-operator threat group exposed valid administrative and SSL VPN credentials for approximately 73,932 internet-facing FortiGate firewalls in 194 countries, harvested via industrial-scale brute-forcing, SSL VPN authentication-hash interception, and offline cracking on a 45-GPU Hashtopolis cluster. Most affected devices reportedly remained online and the credentials were validated as still working, with downstream Active Directory intrusion and suspected espionage including theft of documents from a Turkish NATO defense contractor.
How FortiBleed Campaign works
FortiBleed is a mass credential-exposure campaign publicly disclosed on 2026-06-13 by security researcher Bob (Volodymyr) Diachenko and independently validated by Kevin Beaumont and Hudson Rock. An exposed actor-controlled server was found to contain a dataset of validated administrator and SSL VPN credentials — usernames, email addresses, and plaintext passwords — for 73,932 FortiGate firewall URLs spanning 21,600+ domains across 194 countries, an estimated half of all internet-facing Fortinet firewalls. Named victim organizations in the dataset reportedly include Chevron, Samsung, Foxconn, Comcast, AT&T, Mercedes-Benz, Toyota, Lenovo, PwC, Accenture, and Oracle, alongside government agencies and critical-infrastructure operators.
The operators ran credential attacks at industrial scale: roughly 1.16 billion credential attempts against 320,777 FortiGate targets and a parallel ~2.1 billion attempts against 163,650 Microsoft SQL Server systems. Rather than relying on a single new vulnerability, the campaign aggregated and revalidated credentials from multiple vectors: online brute-forcing/password-spraying, interception of FortiGate SSL VPN authentication hashes, and offline cracking of those hashes using Hashcat orchestrated across a 45-GPU cluster via Hashtopolis. The dataset also incorporates lineage from prior Fortinet credential leaks — the 2021 dump of ~500,000 FortiGate VPN accounts harvested via the CVE-2018-13379 SSL VPN path-traversal flaw, and the January 2025 Belsen Group release of ~15,000 FortiGate device configurations — though FortiBleed is a distinct, larger, and more recent corpus.
Validated credentials were used to access internal networks and Active Directory environments, enabling discovery, lateral movement, collection from network shares, and exfiltration. The actor catalogued credentials by country, sector, and organization revenue, and showed suspected espionage objectives: a Turkish NATO defense contractor reportedly had classified documents exfiltrated, and targeting was observed against organizations in Japan, Taiwan, Vietnam, Iraq, and Türkiye. Operational artifacts left exposed included credential-capture logs (e.g. fg_capture.log), Hashcat/Hashtopolis orchestration files, Active Directory enumeration scripts, password-spraying tooling, and SMB/DFS collection utilities. A single observed indicator, 85.11.187.8 (AS211486), showed HTTP activity on port 9999 on 2026-06-07 and follow-on SSH/VNC/RDP activity on 2026-06-14/15. BeaconBeagle returned no C2 beacon or config correlation for this IP at time of research. Fortinet's remediation path centers on rotating all admin/VPN credentials, enforcing MFA, removing management-interface internet exposure, and upgrading FortiOS to versions implementing PBKDF2 password hashing (7.2.11+, 7.4.8+, 7.6.1+) with forced administrator re-authentication post-upgrade.
MITRE ATT&CK techniques used in TL-2026-0868
Credential Access
T1003 OS Credential Dumping; T1110 Brute Force; T1552 Unsecured Credentials
Collection
T1005 Data from Local System; T1039 Data from Network Shared Drive
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery; T1087 Account Discovery; T1482 Domain Trust Discovery
Lateral Movement
Exfiltration
T1041 Exfiltration Over C2 Channel
Command and Control
T1071 Application Layer Protocol
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Persistence
T1098 Account Manipulation; T1136 Create Account
Resource Development
T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1588 Obtain Capabilities
Reconnaissance
T1589 Gather Victim Identity Information; T1592 Gather Victim Host Information; T1595 Active Scanning
Affected products and versions in FortiBleed Campaign
- Fortinet — FortiGate / FortiOS (SSL VPN and administrative interface)
Vulnerable versions: FortiOS versions storing credentials with weaker hashing prior to PBKDF2 rollout
Fixed in: 7.2.11+; 7.4.8+; 7.6.1+ - Microsoft — Microsoft SQL Server (parallel brute-force target)
Vulnerable versions: internet-exposed instances with weak/guessable credentials
Remediation for FortiBleed Campaign
Patches
- Upgrade FortiOS to versions implementing PBKDF2 password hashing: 7.2.11+, 7.4.8+, or 7.6.1+
- Force administrator re-authentication after upgrade to re-hash stored credentials
Immediate actions
- Rotate ALL FortiGate administrative and SSL VPN credentials, treating every internet-exposed device as compromised
- Remove FortiGate management and SSL VPN interfaces from direct internet exposure; restrict to trusted IPs/VPN
- Hunt logs for logins from 85.11.187.8 (AS211486) and unexpected admin accounts or config changes
- Audit for rogue super_admin accounts (historically named 'fortigate-tech-support' in CVE-2022-40684 abuse)
Workarounds
- Enable 'login-lockout-upon-weaker-encryption' in FortiOS system password-policy
- Disable SSL VPN / management on WAN where not strictly required
Longer-term hardening
- Enforce multi-factor authentication on all administrative and VPN accounts
- Deploy EDR/NDR with behavioral detection across Active Directory and adjacent segments
- Implement credential hygiene: ban reuse, monitor for credentials appearing in leak datasets
- Network segmentation to limit blast radius from a compromised perimeter device into AD
CVEs associated with FortiBleed Campaign
Weaknesses (CWE) in FortiBleed Campaign
CWE-522, CWE-256, CWE-307, CWE-798, CWE-916
Timeline of FortiBleed Campaign
- CVE-2018-13379 (FortiOS SSL VPN path traversal) disclosed; allows unauthenticated reading of session files containing plaintext VPN credentials — later a primary harvesting vector.
- A threat actor leaks ~500,000 FortiGate SSL VPN credentials collected via CVE-2018-13379; lineage later folded into the FortiBleed corpus.
- CVE-2022-40684 exploited in the wild to download FortiGate configs and add rogue super_admin accounts (e.g. 'fortigate-tech-support'), contributing config/credential exposure.
- Belsen Group publishes configs and VPN credentials for ~15,000 FortiGate devices; a distinct, smaller predecessor dataset to FortiBleed.
- Initial malicious activity observed from 85.11.187.8 (AS211486) with HTTP activity on port 9999.
- Findings independently validated by Kevin Beaumont and Hudson Rock; 'data is legit, ~75k devices, almost all still online' — roughly half of internet-facing Fortinet firewalls.
- FortiBleed publicly disclosed by researcher Bob (Volodymyr) Diachenko; dataset of 73,932 validated FortiGate admin/VPN credentials across 194 countries identified on an exposed actor server.
- Follow-on intrusion activity from 85.11.187.8 detected via SSH/VNC/RDP on 2026-06-14/15, consistent with credential-validated remote access and lateral movement.
- Vendor and media security bulletins published (Arctic Wolf, BleepingComputer, CSO Online, Bitsight) with remediation guidance and FortiOS PBKDF2 upgrade path.
- Reporting characterizes the leak as hitting ~half the internet-facing FortiGate fleet, with espionage concerns including a Turkish NATO defense contractor.
Sources cited for FortiBleed Campaign
- FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems
- Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries
- FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices
- FortiBleed Attack Exposes Fortinet Firewall Credentials in 194 Countries
- FortiBleed campaign exposes 75,000 Fortinet firewalls worldwide
- Security Alert: FortiBleed Fortinet VPN Credentials Firewall Exposed
- Hackers Leak VPN Account Passwords From 87,000 Fortinet FortiGate Devices (2021, CVE-2018-13379 lineage)
- Hackers leak configs and VPN credentials for 15,000 FortiGate devices (Belsen Group, 2025)
- Malicious Actor Discloses FortiGate SSL-VPN Credentials (Fortinet PSIRT)
Threats related to FortiBleed Campaign
- FortiBleed — Credential Exposure Campaign Targeting Fortinet FortiGate Firewalls and SSL-VPN Gateways
- FortiBleed: Russian-Speaking Credential-Harvesting Campaign Against Internet-Exposed FortiGate Firewalls and SSL VPN Gateways
- FortiBleed Campaign: Custom FortigateSniffer Abuses FortiOS 'diagnose sniffer packet' to Harvest Credentials Across 24 Protocols
- FortiBleed: Mass Credential Compromise Campaign Against Internet-Exposed Fortinet FortiGate Devices (86,644 Devices, 194 Countries)
- FortiBleed: Large-Scale Credential-Stuffing and Brute-Force Compromise of 73,932 Fortinet FortiGate SSL VPN Firewalls Across 194 Countries
- FortiBleed: Russian Initial-Access-Broker Credential-Harvesting Campaign Weaponizing FortiGate Firewalls with the FortigateSniffer Tool
Detection coverage for TL-2026-0868
As of 2026-06-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0868 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0868
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.