# FortiBleed: Large-Scale Credential-Stuffing and Brute-Force Compromise of 73,932 Fortinet FortiGate SSL VPN Firewalls Across 194 Countries

> FortiBleed is an active campaign by a multi-operator Russian-speaking cybercriminal group that compromised 73,932 unique internet-facing Fortinet FortiGate firewall URLs (roughly half of the internet-exposed fleet) across 194 countries using mass scanning, credential stuffing against infostealer-harvested credential repositories, and offline hash cracking. Microsoft SQL Server systems were targeted as a secondary objective, and the operators pivoted into Active Directory environments for persistence and data theft.

- **Published:** 2026-06-19T00:00:00Z
- **Last reviewed:** 2026-06-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0882
- **ID:** TL-2026-0882
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** FortiBleed operators
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

FortiBleed is a credential-driven mass-compromise campaign disclosed in June 2026 after security researcher Volodymyr 'Bob' Diachenko discovered an exposed dataset and the attackers' own open directory of tooling, scripts, connection strings, logs, and analytics. Hudson Rock and Kevin Beaumont independently validated portions of the dataset. The operation is attributed with moderate confidence to a Russian-speaking, multi-operator cybercriminal collective coordinating via Telegram.

The attackers systematically scanned the internet for Fortinet FortiGate devices exposing SSL VPN portals or management interfaces, then tested credentials at industrial scale: approximately 1.16 billion credential attempts against 320,777 FortiGate targets and approximately 2.1 billion brute-force attempts against 163,650 Microsoft SQL Server systems. Rather than cracking strong passwords directly, the operators primarily matched live targets against vast repositories of historical credentials previously stolen by infostealer malware, which allowed even highly complex 20-character passwords to be 'compromised' because the plaintext had already been exfiltrated from an endpoint. Where hashes were obtained — including intercepted SSL VPN authentication hashes and credentials extracted from device configuration files — the group ran offline cracking on a dedicated 45-GPU cluster orchestrated with Hashtopolis and hashcat. Older FortiGate devices using salted SHA-256 hashing (pre-2025, before Fortinet's early-2025 PBKDF2 hardening) were especially vulnerable to offline cracking.

The end state was administrative access to 73,932 unique FortiGate URLs spanning 21,632 distinct domains in 194 countries. The most affected countries were India (9,629 devices), the United States (6,352), Taiwan (3,637), Mexico (3,197), and Turkey (3,032). After gaining firewall access, the operators pivoted into internal networks, ran Active Directory enumeration and full-domain audits, sprayed credentials, and exfiltrated data from network shares (DFS backups, SMB). Confirmed or reported victims include a Turkish NATO defense contractor (from which classified documents were allegedly exfiltrated) and entries for major enterprises such as Foxconn, Samsung, Comcast, AT&T, Mercedes-Benz, Toyota, Sinopec, State Grid, Siemens, Lenovo, Oracle, Chevron, PwC, and Accenture. The campaign is distinct from the 2025 Belsen Group Fortinet leak (~15,000 devices). Command-and-control / credential-harvesting infrastructure was observed at 85.11.187.8 (AS211486, 85.11.187.0/24), with HTTP activity on port 9999 on 2026-06-07 and SSH/VNC/RDP services active on 2026-06-14 through 2026-06-15.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Vulnerability Scanning
- T1589.001 Credentials
- T1583 Acquire Infrastructure
- T1588.002 Tool
- T1586 Compromise Accounts
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1110.001 Password Guessing
- T1110.002 Password Cracking
- T1110.003 Password Spraying
- T1110.004 Credential Stuffing
- T1040 Network Sniffing
- T1552.001 Credentials In Files
- T1087.002 Domain Account
- T1018 Remote System Discovery
- T1135 Network Share Discovery
- T1021.002 SMB/Windows Admin Shares
- T1021.001 Remote Desktop Protocol
- T1078.002 Domain Accounts
- T1039 Data from Network Shared Drive
- T1071.001 Web Protocols
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel

## Sources

- [FortiBleed - 70,000+ Fortinet Firewalls Compromised in Massive Exploitation Attack](https://cybersecuritynews.com/fortibleed-fortinet-firewalls-compromised/)
- [FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems](https://www.recordedfuture.com/blog/critical-fortibleed-campaign)
- [FortiBleed: 75,000 Fortinet Firewalls Compromised: Global Enterprises Exposed](https://www.infostealers.com/article/fortibleed-75000-fortinet-firewalls-compromised-global-enterprises-exposed-claim-your-ethical-disclosure/)
- [FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices](https://www.bleepingcomputer.com/news/security/fortibleed-leak-exposes-fortinet-vpn-credentials-for-73-000-devices/)
- [FortiBleed campaign exposes 75,000 Fortinet firewalls worldwide](https://www.csoonline.com/article/4186790/fortibleed-campaign-exposes-75000-fortinet-firewalls-worldwide.html)
- [FortiBleed Exposes Admin Passwords for 75,000 Fortinet Firewalls](https://securityaffairs.com/193817/hacking/fortibleed-exposes-admin-passwords-for-75000-fortinet-firewalls.html)
- [FortiBleed Attack Exposes Fortinet Firewall Credentials in 194 Countries](https://hackread.com/fortibleed-attack-fortinet-firewalls-credentials/)
- [Fortinet FortiGate Credential Leak Hits 73,932 Firewalls: Half the Internet-Facing Fleet](https://www.techtimes.com/articles/318599/20260618/fortinet-fortigate-credential-leak-hits-73932-firewalls-half-internet-facing-fleet.htm)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0882