# FortiBleed: Russian-Speaking Credential-Harvesting Campaign Against Internet-Exposed FortiGate Firewalls and SSL VPN Gateways

> FortiBleed is an active, large-scale credential-harvesting campaign in which Russian-speaking threat actors compromised internet-facing FortiGate firewalls and SSL VPN gateways across 194 countries by reusing leaked credentials, brute-forcing weak/MFA-less accounts, and offline-cracking legacy salted-SHA256 FortiOS hashes on a GPU cluster. Public reporting cites 73,932 affected firewall URLs (~50% of the internet-facing fleet) and 30,791 verified working credentials. This is not a new zero-day; it weaponizes weak password hygiene, absent MFA, and credentials exposed in prior Fortinet incidents (FG-IR-26-060, FG-IR-25-647).

- **Published:** 2026-06-21T00:00:00Z
- **Last reviewed:** 2026-10-08T00:48:06.297Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0895
- **ID:** TL-2026-0895
- **Severity:** CRITICAL
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** INC Ransom - G1032 (Russia)
- **Detections:** 9 · **IOCs:** 82 (full data via the Threadlinqs MCP server — Purple tier)

## Description

FortiBleed is a credential-harvesting and credential-validation campaign that targets internet-exposed Fortinet FortiGate firewalls and SSL VPN gateways at global scale. Rather than exploiting a single new vulnerability, the operators chained together previously leaked Fortinet credentials, aggressive automated brute-force / credential-stuffing, and large-scale offline hash cracking against the legacy salted-SHA256 administrator-credential format used by older FortiOS builds.

Researchers (SOCRadar, Arctic Wolf, Recorded Future, CSO Online, SpyCloud, CloudSEK, Field Effect) describe an attacker-controlled open directory and orchestration stack left exposed on the internet. The operators ran a Hashtopolis 0.14.3 instance (reachable at 85.11.187.8:8443) coordinating a roughly 45-GPU cracking cluster (with ~36 Vast.ai rented GPU workers) using Hashcat to recover plaintext administrator and SSL VPN passwords from captured FortiOS config hashes (legacy salted-SHA256, PBKDF2, and krb5pa$18200 Kerberos formats). Telemetry attributed to the campaign includes roughly 1.16 billion credential attempts against 320,777 FortiGate targets and roughly 2.1 billion attempts against 163,650 MSSQL systems, indicating a broad automated credential-validation pipeline beyond Fortinet alone.

The operators maintained databases of validated credentials organized by country, sector, and organization revenue, and an exposed dataset attributed 21,632 entries (largely registration/realm metadata, with only a small fraction confirming real internal compromise — meaning headline breach counts are likely inflated). After authenticating to a FortiGate, attackers deployed passive network sniffers (logging to fg_capture.log) to harvest additional plaintext credentials transiting the perimeter device, created rogue administrator accounts (forticloud, fortiuser, fortinet-support, fortinet-tech-support), modified device configuration, and pivoted toward Active Directory / LDAP-integrated internal environments using enumeration (ad_enum.py, ad_full_audit.py), password spraying (spray_admin.sh, spray_da.py), and SMB/DFS collection-and-exfiltration tooling (backup_dfs.py, spider.py, smb_test.py). At least one working SSL VPN profile into a victim network (vpn5.conf) was found in the exposed directory. Confirmed victims span Japan, Taiwan, Vietnam, Iraq, and Türkiye, with reporting that a NATO defense contractor was targeted and documents allegedly exfiltrated; India, the United States, and Mexico held the largest concentrations of exposed credentials.

FortiOS builds prior to 7.2.11, 7.4.8, and 7.6.1 stored administrator credentials as salted SHA-256, which is feasible to crack offline; later builds (7.4/7.6/8.0 lines, beginning 7.2.11/7.4.8/7.6.1) introduce PBKDF2 hashing. Critically, legacy SHA-256 hashes persist in 'old-password' fields after an upgrade until each administrator logs in, extending the exposure window. Remediation requires terminating all admin/VPN sessions and rotating every credential, enforcing MFA, upgrading FortiOS, enabling 'set login-lockout-upon-weaker-encryption', auditing configurations for rogue accounts and unauthorized changes, restricting management-interface exposure, and reviewing logs and domain-controller telemetry for lateral-movement anomalies.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1586 Compromise Accounts
- T1078 Valid Accounts
- T1133 External Remote Services
- T1190 Exploit Public-Facing Application
- T1110 Brute Force
- T1040 Network Sniffing
- T1552 Unsecured Credentials
- T1555 Credentials from Password Stores
- T1136 Create Account
- T1098 Account Manipulation
- T1070 Indicator Removal
- T1087 Account Discovery
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1021 Remote Services
- T1039 Data from Network Shared Drive
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1595.001 Active Scanning
- T1136.001 Create Account
- T1110.004 Brute Force
- T1110.003 Brute Force
- T1110.002 Brute Force
- T1558.003 Steal or Forge Kerberos Tickets
- T1558.004 Steal or Forge Kerberos Tickets
- T1087.002 Account Discovery
- T1135 Network Share Discovery
- T1021.002 Remote Services
- T1602.002 Network Device Configuration Dump
- T1102.002 Web Service
- T1048.002 Exfiltration Over Alternative Protocol
- T1486 Data Encrypted for Impact
- T1596.005 Search Open Technical Databases

## Sources

- [FortiBleed - Credential Harvesting Campaign Targeting FortiGate Devices](https://cybersecuritynews.com/fortibleed-credential-harvesting-attack/)
- [Analysis of Reported Credential Compromise of FortiGate Devices (Fortinet PSIRT Blog)](https://www.fortinet.com/blog/psirt-blogs/analysis-of-reported-credential-compromise-of-fortigate-devices)
- [Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries (Arctic Wolf)](https://arcticwolf.com/resources/blog/active-fortibleed-campaign-impacting-fortinet-devices-across-194-countries/)
- [FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems (Recorded Future)](https://www.recordedfuture.com/blog/critical-fortibleed-campaign)
- [FortiBleed campaign exposes 75,000 Fortinet firewalls worldwide (CSO Online)](https://www.csoonline.com/article/4186790/fortibleed-campaign-exposes-75000-fortinet-firewalls-worldwide.html)
- [Inside the FortiBleed Open Directory: A Technical Analysis of What the Attacker Left Behind](https://www.hendryadrian.com/inside-the-fortibleed-open-directory-a-technical-analysis-of-what-the-attacker-left-behind/)
- [Inside the FortiBleed Open Directory (CloudSEK)](https://www.cloudsek.com/blog/inside-the-fortibleed-open-directory-a-technical-analysis-of-what-the-attacker-left-behind)
- [FortiBleed exposes Fortinet credentials at global scale (Field Effect)](https://fieldeffect.com/blog/fortibleed-exposes-fortinet-credentials)
- [What SpyCloud Found Inside the FortiBleed Threat Actor Infrastructure](https://spycloud.com/blog/what-spycloud-found-inside-the-fortibleed-threat-actor-infrastructure/)
- [NCSC: Advice following global targeting of Fortinet firewalls and VPN gateways](https://www.ncsc.gov.uk/news/advice-following-global-targeting-of-fortinet-firewalls-and-vpn-gateways)
- [Fortinet FortiGate Credential Leak Hits 73,932 Firewalls (TechTimes)](https://www.techtimes.com/articles/318599/20260618/fortinet-fortigate-credential-leak-hits-73932-firewalls-half-internet-facing-fleet.htm)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0895