FortiBleed Campaign: Custom FortigateSniffer Abuses FortiOS 'diagnose sniffer packet' to Harvest Credentials Across 24 Protocols
FortiBleed Campaign (TL-2026-0907), also tracked as FortiBleed, is a critical-severity campaign, first published 2026-06-22. It is attributed to FortiBleed operator (Russia) with medium confidence, affects Fortinet FortiGate / FortiOS, maps to 29 MITRE ATT&CK techniques (T1005, T1018, T1021), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0907
- Threat ID
- TL-2026-0907
- Also known as
- FortiBleed
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- CAMPAIGN
- First published
- 2026-06-22
- Last reviewed
- 2026-06-22
- Attribution
- FortiBleed operator
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- government, telecommunications, financial, healthcare, manufacturing, it-services, defense
- Target regions
- Global, India, United States, Taiwan, Europe, Asia
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in FortiBleed Campaign
Malware and tooling: FortiProbe-fast, FortigateSniffer, Hashtopolis + Hashcat (36-45 GPU cluster, vast.ai, Telegram), PCAP Deep Analysis Toolkit, SNIFTRAN, Shodan_Recon
FortiBleed is a large-scale Russian-speaking credential-harvesting operation, active since at least February 2026, that compromised hundreds of thousands of internet-facing FortiGate firewalls. After gaining admin/SSH access via brute-force and credential stuffing, the actor deploys a custom Golang sniffer (FortigateSniffer) that abuses the legitimate FortiOS 'diagnose sniffer packet' diagnostic command to passively capture authentication traffic across 24 protocols, then reconstructs and cracks the harvested credentials offline at scale.
How FortiBleed Campaign works
FortiBleed is a credential-harvesting and initial-access-broker (IAB) operation publicly surfaced on 2026-06-13 by researcher Volodymyr 'Bob' Diachenko and corroborated by Kevin Beaumont, Hudson Rock, Huntress, SOCRadar, Recorded Future and others. The campaign does not rely on a zero-day; instead it monetizes weak/legacy FortiGate authentication. Operators first enumerate exposed FortiGate devices using reconnaissance tooling (Masscan, a custom Shodan_Recon utility, and a FortiProbe-fast binary), then gain administrative access through large-scale SSH brute-forcing (reportedly 16 curated wordlists), credential stuffing against SSL-VPN portals using previously leaked credentials, and the theft of exported FortiGate configuration files that contain hashed credentials.
Once a device is owned, the actor connects over SSH and runs a custom Golang implant, FortigateSniffer, which wraps the legitimate FortiOS troubleshooting command 'diagnose sniffer packet'. This 'living-off-the-land' approach captures plaintext and challenge/response authentication traffic for 24 protocols traversing the firewall — including Kerberos, RADIUS, NTLM, LDAP, SMB, RDP, WinRM, Microsoft SQL Server, MySQL, PostgreSQL, SMTP, IMAP, POP3, FTP and Telnet — without dropping conventional malware on the host. Captured packets are written to logs such as fg_capture.log. The sniffer is reported to run only between 07:00 and 18:00 Moscow Time to blend with legitimate business-hours traffic, a deliberate defense-evasion choice that also localizes the operators to a Russian/Eastern-European timezone (Cyrillic comments were observed in tooling).
Captured traffic is reconstructed into PCAP files by a component named SNIFTRAN and parsed by a Python 'PCAP Deep Analysis Toolkit' that extracts cleartext credentials, password hashes, Kerberos tickets, NTLM authentication material, and database/email credentials, emitting Hashcat-ready files. Hashes are cracked on a distributed GPU cluster (reported at 36-45 enterprise GPUs) orchestrated with Hashtopolis and Hashcat, using rented vast.ai capacity and Telegram bots for telemetry/coordination. Recovered valid credentials feed Active Directory enumeration (ad_enum.py, ad_full_audit.py), password spraying (spray_*.sh/py), and SMB/DFS data collection and exfiltration (backup_dfs.py, spider.py, smb_test.py), enabling deep network pivoting.
Reported scale is severe: 430,000+ FortiGate firewalls targeted; ~73,932-86,644 devices with confirmed valid admin/SSL-VPN credentials across 194 countries and 21,600+ domains; over 110 million credentials across 659+ harvesting pipelines; ~19,000 devices actively sniffed at time of reporting; and 1.16 billion brute-force attempts against 320,777 FortiGate targets plus 2.1 billion against 163,650 MSSQL systems. Victims skew toward SMBs (≈66% under 200 employees) but include government, telecom, financial, healthcare and manufacturing organizations, and an alleged NATO-aligned defense contractor compromise. Fortinet issued PSIRT guidance (FG-IR-26-060, related FG-IR-25-647) and CISA alerted on it; mitigation centers on credential reset, MFA, PBKDF2 password storage (FortiOS 7.4/7.6/8.0), disabling internet-exposed management, and hunting for unauthorized admin accounts (e.g., forticloud, fortiuser, fortinet-support).
MITRE ATT&CK techniques used in TL-2026-0907
Collection
T1005 Data from Local System; T1039 Data from Network Shared Drive
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery; T1087 Account Discovery
Lateral Movement
T1021 Remote Services; T1550 Use Alternate Authentication Material
Defense Evasion
T1036 Masquerading; T1070 Indicator Removal
Credential Access
T1040 Network Sniffing; T1110 Brute Force; T1552 Unsecured Credentials; T1557 Adversary-in-the-Middle
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1571 Non-Standard Port
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Persistence
T1078 Valid Accounts; T1136 Create Account
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities
Reconnaissance
T1590 Gather Victim Network Information; T1595 Active Scanning; T1596 Search Open Technical Databases
Affected products and versions in FortiBleed Campaign
- Fortinet — FortiGate / FortiOS
Vulnerable versions: FortiOS versions prior to 7.4; prior to 7.6; prior to 8.0 (legacy non-PBKDF2 password hashing; internet-exposed management/SSL-VPN)
Fixed in: 7.4 (PBKDF2); 7.6 (PBKDF2); 8.0 (PBKDF2)
Remediation for FortiBleed Campaign
Patches
- Upgrade to FortiOS 7.4, 7.6 or 8.0 which support PBKDF2-based password hashing
- Follow Fortinet PSIRT advisories FG-IR-26-060 and FG-IR-25-647
Immediate actions
- Treat any internet-exposed FortiGate with weak/legacy auth as fully compromised; terminate all active administrative and SSL-VPN sessions
- Reset all FortiGate admin and VPN credentials, plus any Active Directory/LDAP/RADIUS/database/email credentials that may have traversed the firewall
- Audit admin account list for unauthorized persistence accounts such as 'forticloud', 'fortiuser', 'fortinet-support'
- Hunt for the 'diagnose sniffer packet' command in CLI/audit logs and for capture artifacts (e.g. fg_capture.log)
- Block known harvesting infrastructure (e.g. 85.11.187.8 / AS211486) and traffic to TCP/9999 at the perimeter
Workarounds
- Disable SSL-VPN and external admin access where not strictly required
- Enforce strong password policy and lockout to blunt brute-force/credential-stuffing
Longer-term hardening
- Mandate phishing-resistant MFA for all admin and SSL-VPN accounts
- Restrict device management to trusted hosts and disable internet-facing administrative interfaces; use local-in policies
- Deploy network/EDR detection for AiTM credential capture and for offline-cracking-driven lateral movement (AD enumeration, password spraying, SMB/DFS exfiltration)
Weaknesses (CWE) in FortiBleed Campaign
CWE-1392, CWE-307, CWE-522, CWE-319, CWE-916
Timeline of FortiBleed Campaign
- FortiBleed credential-harvesting operation active since at least February 2026, targeting internet-facing FortiGate firewalls.
- HTTP activity observed on TCP port 9999 associated with the harvesting infrastructure.
- Researcher Volodymyr 'Bob' Diachenko publicly disclosed the FortiBleed dataset (~73,932 FortiGate URLs); validated by Kevin Beaumont and Hudson Rock.
- Packet-capture and attack activity against authentication services (SSH, VNC, RDP) first observed across compromised FortiGate devices, marking the start of the June 14-15 capture window.
- SSH, VNC and RDP attack/capture activity continued and peaked across compromised devices through June 15.
- CISA alerted on the campaign and PwnDefend corroborated findings.
- Fortinet PSIRT issued guidance (FG-IR-26-060, related FG-IR-25-647) confirming no zero-day; SecurityWeek reports ~86,644 confirmed credentials.
- BleepingComputer and SecurityAffairs detail FortigateSniffer tooling; ~19,000 devices reported actively sniffed.
Sources cited for FortiBleed Campaign
- FortiBleed campaign used custom FortiGate sniffer to steal credentials
- FortiBleed: The Most Detailed Breakdown Yet of an Active Russian Credential-Harvesting Operation
- Critical FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems
- Dismantling FortiBleed: Inside a Russian Fortinet Compromise Operation
- FortiBleed: 86,000 Fortinet Device Credentials Compromised
- Fortinet Warns of Active FortiBleed Credential Theft Attacks
- Security Alert: FortiBleed - Fortinet VPN Credentials Exposed
- FortiBleed exposes Fortinet credentials at global scale
- No Zero-Day Tied to 80,000 Harvested Fortinet Credentials
- How to Protect Fortinet FortiGate Firewalls From The FortiBleed Credential Leak
- Kevin Beaumont - partial FortiBleed targeted IP list
Threats related to FortiBleed Campaign
- FortiBleed: Russian Initial-Access-Broker Credential-Harvesting Campaign Weaponizing FortiGate Firewalls with the FortigateSniffer Tool
- FortiBleed: Russian-Speaking Credential-Harvesting Campaign Against Internet-Exposed FortiGate Firewalls and SSL VPN Gateways
- FortiBleed Credential-Theft Campaign Linked to INC and Lynx Ransomware Operations
- FortiBleed — Credential Exposure Campaign Targeting Fortinet FortiGate Firewalls and SSL-VPN Gateways
- FortiBleed: Large-Scale Credential-Stuffing and Brute-Force Compromise of 73,932 Fortinet FortiGate SSL VPN Firewalls Across 194 Countries
- FortiBleed Credential Theft Campaign: FortigateSniffer Tool Deployed Against 430,000+ FortiGate Firewalls, Linked to INC Ransom and Lynx Ransomware
Detection coverage for TL-2026-0907
As of 2026-06-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0907 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0907
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.