FortiBleed: Large-Scale Credential-Stuffing and Brute-Force Compromise of 73,932 Fortinet FortiGate SSL VPN Firewalls Across 194 Countries

FortiBleed: Large-Scale Credential-Stuffing and Brute-Force (TL-2026-0882), also tracked as FortiBleed, is a high-severity tracked intrusion set, first published 2026-06-19. It is attributed to FortiBleed operators with medium confidence, affects Fortinet FortiGate / FortiOS (SSL VPN and management interface), maps to 25 MITRE ATT&CK techniques (T1018, T1021.001, T1021.002), and is covered by 9 detection rules and 23 indicators of compromise.

Key facts for TL-2026-0882

Threat ID
TL-2026-0882
Also known as
FortiBleed
Severity
HIGH
Status
ACTIVE
Category
THREAT_INTEL
First published
2026-06-19
Last reviewed
2026-06-19
Attribution
FortiBleed operators
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
it-services, telecommunications, financial-services, government, defense, manufacturing, automotive, energy, healthcare, education, construction-materials
Target regions
Asia, North America, Europe, Middle East, Latin America, Global
Detection rules
9
Indicators of compromise
23

Malware and tooling in FortiBleed: Large-Scale Credential-Stuffing and Brute-Force

Malware and tooling: Hashtopolis, Telegram, hashcat

FortiBleed is an active campaign by a multi-operator Russian-speaking cybercriminal group that compromised 73,932 unique internet-facing Fortinet FortiGate firewall URLs (roughly half of the internet-exposed fleet) across 194 countries using mass scanning, credential stuffing against infostealer-harvested credential repositories, and offline hash cracking. Microsoft SQL Server systems were targeted as a secondary objective, and the operators pivoted into Active Directory environments for persistence and data theft.

How FortiBleed: Large-Scale Credential-Stuffing and Brute-Force works

FortiBleed is a credential-driven mass-compromise campaign disclosed in June 2026 after security researcher Volodymyr 'Bob' Diachenko discovered an exposed dataset and the attackers' own open directory of tooling, scripts, connection strings, logs, and analytics. Hudson Rock and Kevin Beaumont independently validated portions of the dataset. The operation is attributed with moderate confidence to a Russian-speaking, multi-operator cybercriminal collective coordinating via Telegram.

The attackers systematically scanned the internet for Fortinet FortiGate devices exposing SSL VPN portals or management interfaces, then tested credentials at industrial scale: approximately 1.16 billion credential attempts against 320,777 FortiGate targets and approximately 2.1 billion brute-force attempts against 163,650 Microsoft SQL Server systems. Rather than cracking strong passwords directly, the operators primarily matched live targets against vast repositories of historical credentials previously stolen by infostealer malware, which allowed even highly complex 20-character passwords to be 'compromised' because the plaintext had already been exfiltrated from an endpoint. Where hashes were obtained — including intercepted SSL VPN authentication hashes and credentials extracted from device configuration files — the group ran offline cracking on a dedicated 45-GPU cluster orchestrated with Hashtopolis and hashcat. Older FortiGate devices using salted SHA-256 hashing (pre-2025, before Fortinet's early-2025 PBKDF2 hardening) were especially vulnerable to offline cracking.

The end state was administrative access to 73,932 unique FortiGate URLs spanning 21,632 distinct domains in 194 countries. The most affected countries were India (9,629 devices), the United States (6,352), Taiwan (3,637), Mexico (3,197), and Turkey (3,032). After gaining firewall access, the operators pivoted into internal networks, ran Active Directory enumeration and full-domain audits, sprayed credentials, and exfiltrated data from network shares (DFS backups, SMB). Confirmed or reported victims include a Turkish NATO defense contractor (from which classified documents were allegedly exfiltrated) and entries for major enterprises such as Foxconn, Samsung, Comcast, AT&T, Mercedes-Benz, Toyota, Sinopec, State Grid, Siemens, Lenovo, Oracle, Chevron, PwC, and Accenture. The campaign is distinct from the 2025 Belsen Group Fortinet leak (~15,000 devices). Command-and-control / credential-harvesting infrastructure was observed at 85.11.187.8 (AS211486, 85.11.187.0/24), with HTTP activity on port 9999 on 2026-06-07 and SSH/VNC/RDP services active on 2026-06-14 through 2026-06-15.

MITRE ATT&CK techniques used in TL-2026-0882

Discovery

T1018 Remote System Discovery; T1087.002 Domain Account; T1135 Network Share Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares

Collection

T1039 Data from Network Shared Drive

Credential Access

T1040 Network Sniffing; T1110.001 Password Guessing; T1110.002 Password Cracking; T1110.003 Password Spraying; T1110.004 Credential Stuffing; T1552.001 Credentials In Files

Exfiltration

T1041 Exfiltration Over C2 Channel

Command and Control

T1071.001 Web Protocols; T1102 Web Service

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Persistence

T1078.002 Domain Accounts

Resource Development

T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1588.002 Tool

Reconnaissance

T1589.001 Credentials; T1595 Active Scanning; T1595.002 Vulnerability Scanning

Affected products and versions in FortiBleed: Large-Scale Credential-Stuffing and Brute-Force

  • Fortinet — FortiGate / FortiOS (SSL VPN and management interface)
    Vulnerable versions: Pre-2025 FortiOS releases using salted SHA-256 password hashing; Any FortiOS with internet-exposed SSL VPN or management interface and reused/leaked credentials
    Fixed in: FortiOS releases with PBKDF2 password hashing (early-2025 hardening) plus MFA and management-access restriction
  • Microsoft — SQL Server (MSSQL)
    Vulnerable versions: Internet-exposed MSSQL instances with weak or reused credentials

Remediation for FortiBleed: Large-Scale Credential-Stuffing and Brute-Force

Patches

  • Upgrade FortiOS to a current release using PBKDF2 password hashing (early-2025 hardening) so config-extracted hashes resist offline cracking
  • Apply all vendor FortiOS security updates

Immediate actions

  • Force a full credential rotation for all FortiGate local admin, SSL VPN, and any LDAP/AD-integrated accounts used on affected gateways
  • Restrict management-interface and SSL VPN access to trusted source IPs / VPN-only; remove direct internet exposure of the FortiGate management interface
  • Enforce universal MFA on all SSL VPN and administrative logins
  • Audit gateway logs for anomalous logins, configuration exports, and connections from 85.11.187.8 / 85.11.187.0/24

Workarounds

  • Disable FortiCloud SSO if not required
  • Disable or strictly firewall internet-facing MSSQL instances and enforce strong unique SA/service-account credentials

Longer-term hardening

  • Deploy EDR with behavioral detection across the internal estate to catch post-firewall AD enumeration and lateral movement
  • Deploy infostealer-credential monitoring so employee credentials exposed by stealer malware are rotated proactively
  • Implement network segmentation so a compromised edge firewall cannot reach Active Directory and file servers freely
  • Continuous attack-surface monitoring for inadvertently exposed FortiGate/MSSQL management services

Weaknesses (CWE) in FortiBleed: Large-Scale Credential-Stuffing and Brute-Force

CWE-307, CWE-521, CWE-798, CWE-916, CWE-1392

Timeline of FortiBleed: Large-Scale Credential-Stuffing and Brute-Force

  • Separate 2025 Belsen Group Fortinet leak (~15,000 devices) — distinct from FortiBleed but illustrates ongoing FortiGate credential-exposure risk.
  • Fortinet implements PBKDF2 password-hashing hardening in FortiOS; pre-2025 devices remain on salted SHA-256 and are more vulnerable to offline cracking of config-extracted hashes.
  • HTTP activity observed on port 9999 at C2/credential-harvesting host 85.11.187.8 (AS211486); early reconnaissance phase.
  • Researcher Volodymyr 'Bob' Diachenko publicly reports the FortiBleed dataset of compromised Fortinet firewalls.
  • SSH, VNC, and RDP services active on attacker infrastructure (85.11.187.8); active intrusion and lateral-movement operations observed.
  • Continued active intrusion operations; credential spraying and Active Directory enumeration against compromised estates.
  • Cyber Security News publishes campaign analysis; scale confirmed at 73,932 unique FortiGate URLs across 194 countries and 21,632 domains.
  • Hudson Rock, Kevin Beaumont, Recorded Future and others corroborate the dataset and publish technical analysis, including attacker open-directory tooling.

Sources cited for FortiBleed: Large-Scale Credential-Stuffing and Brute-Force

Threats related to FortiBleed: Large-Scale Credential-Stuffing and Brute-Force

Detection coverage for TL-2026-0882

As of 2026-06-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0882 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-0882

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats