# FortiBleed Campaign: Custom FortigateSniffer Abuses FortiOS 'diagnose sniffer packet' to Harvest Credentials Across 24 Protocols

> FortiBleed is a large-scale Russian-speaking credential-harvesting operation, active since at least February 2026, that compromised hundreds of thousands of internet-facing FortiGate firewalls. After gaining admin/SSH access via brute-force and credential stuffing, the actor deploys a custom Golang sniffer (FortigateSniffer) that abuses the legitimate FortiOS 'diagnose sniffer packet' diagnostic command to passively capture authentication traffic across 24 protocols, then reconstructs and cracks the harvested credentials offline at scale.

- **Published:** 2026-06-22T00:00:00Z
- **Last reviewed:** 2026-06-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0907
- **ID:** TL-2026-0907
- **Severity:** CRITICAL
- **Category:** CAMPAIGN
- **Status:** ACTIVE
- **Actor:** FortiBleed operator (Russia)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

FortiBleed is a credential-harvesting and initial-access-broker (IAB) operation publicly surfaced on 2026-06-13 by researcher Volodymyr 'Bob' Diachenko and corroborated by Kevin Beaumont, Hudson Rock, Huntress, SOCRadar, Recorded Future and others. The campaign does not rely on a zero-day; instead it monetizes weak/legacy FortiGate authentication. Operators first enumerate exposed FortiGate devices using reconnaissance tooling (Masscan, a custom Shodan_Recon utility, and a FortiProbe-fast binary), then gain administrative access through large-scale SSH brute-forcing (reportedly 16 curated wordlists), credential stuffing against SSL-VPN portals using previously leaked credentials, and the theft of exported FortiGate configuration files that contain hashed credentials.

Once a device is owned, the actor connects over SSH and runs a custom Golang implant, FortigateSniffer, which wraps the legitimate FortiOS troubleshooting command 'diagnose sniffer packet'. This 'living-off-the-land' approach captures plaintext and challenge/response authentication traffic for 24 protocols traversing the firewall — including Kerberos, RADIUS, NTLM, LDAP, SMB, RDP, WinRM, Microsoft SQL Server, MySQL, PostgreSQL, SMTP, IMAP, POP3, FTP and Telnet — without dropping conventional malware on the host. Captured packets are written to logs such as fg_capture.log. The sniffer is reported to run only between 07:00 and 18:00 Moscow Time to blend with legitimate business-hours traffic, a deliberate defense-evasion choice that also localizes the operators to a Russian/Eastern-European timezone (Cyrillic comments were observed in tooling).

Captured traffic is reconstructed into PCAP files by a component named SNIFTRAN and parsed by a Python 'PCAP Deep Analysis Toolkit' that extracts cleartext credentials, password hashes, Kerberos tickets, NTLM authentication material, and database/email credentials, emitting Hashcat-ready files. Hashes are cracked on a distributed GPU cluster (reported at 36-45 enterprise GPUs) orchestrated with Hashtopolis and Hashcat, using rented vast.ai capacity and Telegram bots for telemetry/coordination. Recovered valid credentials feed Active Directory enumeration (ad_enum.py, ad_full_audit.py), password spraying (spray_*.sh/py), and SMB/DFS data collection and exfiltration (backup_dfs.py, spider.py, smb_test.py), enabling deep network pivoting.

Reported scale is severe: 430,000+ FortiGate firewalls targeted; ~73,932-86,644 devices with confirmed valid admin/SSL-VPN credentials across 194 countries and 21,600+ domains; over 110 million credentials across 659+ harvesting pipelines; ~19,000 devices actively sniffed at time of reporting; and 1.16 billion brute-force attempts against 320,777 FortiGate targets plus 2.1 billion against 163,650 MSSQL systems. Victims skew toward SMBs (≈66% under 200 employees) but include government, telecom, financial, healthcare and manufacturing organizations, and an alleged NATO-aligned defense contractor compromise. Fortinet issued PSIRT guidance (FG-IR-26-060, related FG-IR-25-647) and CISA alerted on it; mitigation centers on credential reset, MFA, PBKDF2 password storage (FortiOS 7.4/7.6/8.0), disabling internet-exposed management, and hunting for unauthorized admin accounts (e.g., forticloud, fortiuser, fortinet-support).

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1596 Search Open Technical Databases
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1136 Create Account
- T1078 Valid Accounts
- T1070 Indicator Removal
- T1036 Masquerading
- T1110 Brute Force
- T1040 Network Sniffing
- T1557 Adversary-in-the-Middle
- T1552 Unsecured Credentials
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1087 Account Discovery
- T1021 Remote Services
- T1550 Use Alternate Authentication Material
- T1039 Data from Network Shared Drive
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1102 Web Service
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service

## Sources

- [FortiBleed campaign used custom FortiGate sniffer to steal credentials](https://www.bleepingcomputer.com/news/security/fortibleed-campaign-used-custom-fortigate-sniffer-to-steal-credentials/)
- [FortiBleed: The Most Detailed Breakdown Yet of an Active Russian Credential-Harvesting Operation](https://securityaffairs.com/194004/hacking/fortibleed-the-most-detailed-breakdown-yet-of-an-active-russian-credential-harvesting-operation.html)
- [Critical FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems](https://www.recordedfuture.com/blog/critical-fortibleed-campaign)
- [Dismantling FortiBleed: Inside a Russian Fortinet Compromise Operation](https://socradar.io/resources/whitepapers/dismantling-fortibleed-inside-a-russian-fortinet-compromise-operation/)
- [FortiBleed: 86,000 Fortinet Device Credentials Compromised](https://www.securityweek.com/fortibleed-86000-fortinet-device-credentials-compromised/)
- [Fortinet Warns of Active FortiBleed Credential Theft Attacks](https://gbhackers.com/fortinet-warns-of-active-fortibleed-credential-theft-attacks/)
- [Security Alert: FortiBleed - Fortinet VPN Credentials Exposed](https://www.bitsight.com/blog/security-alert-fortibleed-fortinet-vpn-credentials-firewall-exposed)
- [FortiBleed exposes Fortinet credentials at global scale](https://fieldeffect.com/blog/fortibleed-exposes-fortinet-credentials)
- [No Zero-Day Tied to 80,000 Harvested Fortinet Credentials](https://www.govinfosecurity.com/no-zero-day-tied-to-80000-harvested-fortinet-credentials-a-32035)
- [How to Protect Fortinet FortiGate Firewalls From The FortiBleed Credential Leak](https://lumu.io/blog/fortibleed-credential-leak-fortinet-fortigate/)
- [Kevin Beaumont - partial FortiBleed targeted IP list](https://owned.lab6.com/~gossi/research/public/fortibleed/some-fortibleed-ips.txt)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0907