# FortiBleed Campaign: Mass FortiGate SSL VPN / Admin Credential Exposure Affecting ~73,932 Fortinet Firewalls Across 194 Countries

> A Russian-speaking, multi-operator threat group exposed valid administrative and SSL VPN credentials for approximately 73,932 internet-facing FortiGate firewalls in 194 countries, harvested via industrial-scale brute-forcing, SSL VPN authentication-hash interception, and offline cracking on a 45-GPU Hashtopolis cluster. Most affected devices reportedly remained online and the credentials were validated as still working, with downstream Active Directory intrusion and suspected espionage including theft of documents from a Turkish NATO defense contractor.

- **Published:** 2026-06-13T00:00:00Z
- **Last reviewed:** 2026-06-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0868
- **ID:** TL-2026-0868
- **Severity:** CRITICAL
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2018-13379, CVE-2022-40684

## Description

FortiBleed is a mass credential-exposure campaign publicly disclosed on 2026-06-13 by security researcher Bob (Volodymyr) Diachenko and independently validated by Kevin Beaumont and Hudson Rock. An exposed actor-controlled server was found to contain a dataset of validated administrator and SSL VPN credentials — usernames, email addresses, and plaintext passwords — for 73,932 FortiGate firewall URLs spanning 21,600+ domains across 194 countries, an estimated half of all internet-facing Fortinet firewalls. Named victim organizations in the dataset reportedly include Chevron, Samsung, Foxconn, Comcast, AT&T, Mercedes-Benz, Toyota, Lenovo, PwC, Accenture, and Oracle, alongside government agencies and critical-infrastructure operators.

The operators ran credential attacks at industrial scale: roughly 1.16 billion credential attempts against 320,777 FortiGate targets and a parallel ~2.1 billion attempts against 163,650 Microsoft SQL Server systems. Rather than relying on a single new vulnerability, the campaign aggregated and revalidated credentials from multiple vectors: online brute-forcing/password-spraying, interception of FortiGate SSL VPN authentication hashes, and offline cracking of those hashes using Hashcat orchestrated across a 45-GPU cluster via Hashtopolis. The dataset also incorporates lineage from prior Fortinet credential leaks — the 2021 dump of ~500,000 FortiGate VPN accounts harvested via the CVE-2018-13379 SSL VPN path-traversal flaw, and the January 2025 Belsen Group release of ~15,000 FortiGate device configurations — though FortiBleed is a distinct, larger, and more recent corpus.

Validated credentials were used to access internal networks and Active Directory environments, enabling discovery, lateral movement, collection from network shares, and exfiltration. The actor catalogued credentials by country, sector, and organization revenue, and showed suspected espionage objectives: a Turkish NATO defense contractor reportedly had classified documents exfiltrated, and targeting was observed against organizations in Japan, Taiwan, Vietnam, Iraq, and Türkiye. Operational artifacts left exposed included credential-capture logs (e.g. fg_capture.log), Hashcat/Hashtopolis orchestration files, Active Directory enumeration scripts, password-spraying tooling, and SMB/DFS collection utilities. A single observed indicator, 85.11.187.8 (AS211486), showed HTTP activity on port 9999 on 2026-06-07 and follow-on SSH/VNC/RDP activity on 2026-06-14/15. BeaconBeagle returned no C2 beacon or config correlation for this IP at time of research. Fortinet's remediation path centers on rotating all admin/VPN credentials, enforcing MFA, removing management-interface internet exposure, and upgrading FortiOS to versions implementing PBKDF2 password hashing (7.2.11+, 7.4.8+, 7.6.1+) with forced administrator re-authentication post-upgrade.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1589 Gather Victim Identity Information
- T1588 Obtain Capabilities
- T1586 Compromise Accounts
- T1583 Acquire Infrastructure
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1110 Brute Force
- T1552 Unsecured Credentials
- T1003 OS Credential Dumping
- T1087 Account Discovery
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1482 Domain Trust Discovery
- T1021 Remote Services
- T1136 Create Account
- T1098 Account Manipulation
- T1005 Data from Local System
- T1039 Data from Network Shared Drive
- T1041 Exfiltration Over C2 Channel
- T1071 Application Layer Protocol

## Sources

- [FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems](https://www.recordedfuture.com/blog/critical-fortibleed-campaign)
- [Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries](https://arcticwolf.com/resources/blog/active-fortibleed-campaign-impacting-fortinet-devices-across-194-countries/)
- [FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices](https://www.bleepingcomputer.com/news/security/fortibleed-leak-exposes-fortinet-vpn-credentials-for-73-000-devices/)
- [FortiBleed Attack Exposes Fortinet Firewall Credentials in 194 Countries](https://hackread.com/fortibleed-attack-fortinet-firewalls-credentials/)
- [FortiBleed campaign exposes 75,000 Fortinet firewalls worldwide](https://www.csoonline.com/article/4186790/fortibleed-campaign-exposes-75000-fortinet-firewalls-worldwide.html)
- [Security Alert: FortiBleed Fortinet VPN Credentials Firewall Exposed](https://www.bitsight.com/blog/security-alert-fortibleed-fortinet-vpn-credentials-firewall-exposed)
- [Hackers Leak VPN Account Passwords From 87,000 Fortinet FortiGate Devices (2021, CVE-2018-13379 lineage)](https://thehackernews.com/2021/09/hackers-leak-vpn-account-passwords-from.html)
- [Hackers leak configs and VPN credentials for 15,000 FortiGate devices (Belsen Group, 2025)](https://www.bleepingcomputer.com/news/security/hackers-leak-configs-and-vpn-credentials-for-15-000-fortigate-devices/)
- [Malicious Actor Discloses FortiGate SSL-VPN Credentials (Fortinet PSIRT)](https://www.fortinet.com/blog/psirt-blogs/malicious-actor-discloses-fortigate-ssl-vpn-credentials)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0868