FortiBleed — Credential Exposure Campaign Targeting Fortinet FortiGate Firewalls and SSL-VPN Gateways
FortiBleed — Credential Exposure Campaign Targeting Fortinet (TL-2026-0916), also tracked as FortiBleed, is a critical-severity data breach, first published 2026-06-23. It carries a reported Russia nexus and is not formally attributed, affects Fortinet FortiGate Firewall (FortiOS), maps to 21 MITRE ATT&CK techniques (T1018, T1021, T1039), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-0916
- Threat ID
- TL-2026-0916
- Also known as
- FortiBleed
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- 2026-06-23
- Last reviewed
- 2026-06-23
- Attribution confidence
- NONE
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- government, telecommunications, financial, healthcare, manufacturing, critical infrastructure, defense
- Target regions
- Global, Asia, Europe, Middle East, North America
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in FortiBleed — Credential Exposure Campaign Targeting Fortinet
Malware and tooling: Hashcat, Hashtopolis
FortiBleed is an active campaign in which a large dataset of valid Fortinet administrative and SSL-VPN credentials — covering ~73,932 FortiGate firewall URLs across 21,600+ domains in 194 countries — is being weaponized against internet-facing FortiGate devices. Credentials were recovered by offline GPU cracking of weak SHA-256-salted password hashes pulled from exported FortiGate configuration files, then reused for remote access and lateral movement. Fortinet PSIRT confirmed no new vulnerability or zero-day is involved.
How FortiBleed — Credential Exposure Campaign Targeting Fortinet works
FortiBleed is a credential-exposure and credential-harvesting campaign first publicly disclosed on 2026-06-13 by security researcher Volodymyr 'Bob' Diachenko and corroborated by Kevin Beaumont (DoublePulsar), Hudson Rock, and PwnDefend. The leaked dataset contains valid administrative and SSL-VPN credentials — usernames, email addresses, plaintext passwords, VPN credentials, and administrative access credentials — for approximately 73,932 unique internet-facing FortiGate firewall URLs spanning 21,600+ domains in 194 countries. Independent estimates place the affected population at roughly 50% of all internet-facing Fortinet firewalls (per Shodan polling), with later tallies reporting up to 86,644 devices.
Researchers assessed that the dataset originated from exported FortiGate configuration files rather than intercepted network traffic. FortiGate stores administrator passwords as SHA-256 hashes with a salt — a fast, weak hashing scheme — until an administrator manually logs in after upgrading to firmware that supports PBKDF2 (introduced in early-2025 builds). Attackers cracked these hashes offline using a 45-GPU cluster orchestrated via Hashtopolis/Hashcat, recovering plaintext credentials without needing ongoing access to the targeted devices. According to Diachenko's investigation, the operators conducted roughly 1.16 billion credential attempts against 320,777 FortiGate targets and approximately 2.1 billion credential attempts against 163,650 Microsoft SQL Server (MSSQL) systems. The exposed dataset also included a business-intelligence layer — company industry, revenue, employee count, and formatted broker-style comments — typical of criminal initial-access markets.
The recovered credentials enable attackers to authenticate to FortiGate management portals and SSL-VPN gateways, change security controls, create backdoor administrator accounts, and pivot into internal networks. Attacker tooling discovered in an exposed directory included Hashtopolis orchestration (bot.py, hashpanel.log, setup files), Active Directory enumeration and audit scripts (ad_enum.py, ad_full_audit.py), password-spraying utilities, and SMB/DFS collection scripts with exfiltration capability, alongside log-clearing markers indicating deliberate evidence removal. Attacker infrastructure was tied to 85.11.187.8 within AS211486 (85.11.187.0/24), observed serving HTTP on port 9999 (2026-06-07) and exhibiting SSH/VNC/RDP activity (2026-06-14 to 2026-06-15). Named or reported victims include organizations in Japan, Taiwan, Vietnam, Iraq, and Türkiye — among them a Turkish NATO defense contractor from which classified documents were allegedly exfiltrated — and the dataset references large enterprises across government, telecommunications, financial services, healthcare, manufacturing, and critical infrastructure.
Fortinet PSIRT (advisory published 2026-06-19, referencing prior advisories FG-IR-26-060 and FG-IR-25-647) confirmed the activity is credential reuse from prior incidents combined with brute-force techniques against devices with weak password hygiene and no multi-factor authentication — explicitly not a new vulnerability or zero-day. Because there is no software flaw to patch, remediation depends on credential rotation, MFA, firmware upgrade to versions that store admin credentials with PBKDF2 (7.4 / 7.6 / 8.0), and removal of internet-facing management exposure. Researchers note the underlying pattern echoes the 2019 mass leak of ~500,000 Fortinet SSL-VPN credentials harvested via CVE-2018-13379, and that the original config-file acquisition vector for some devices may trace to known or undisclosed FortiOS vulnerabilities.
MITRE ATT&CK techniques used in TL-2026-0916
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery; T1087 Account Discovery
Lateral Movement
Collection
T1039 Data from Network Shared Drive
Credential Access
T1040 Network Sniffing; T1110 Brute Force; T1552 Unsecured Credentials
Exfiltration
T1041 Exfiltration Over C2 Channel
Defense Evasion
Command and Control
T1071 Application Layer Protocol
Initial Access
T1078 Valid Accounts; T1133 External Remote Services
Persistence
T1098 Account Manipulation; T1136 Create Account
defense-impairment
T1556 Modify Authentication Process
Resource Development
T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1588 Obtain Capabilities
Reconnaissance
T1589 Gather Victim Identity Information; T1595 Active Scanning
Affected products and versions in FortiBleed — Credential Exposure Campaign Targeting Fortinet
- Fortinet — FortiGate Firewall (FortiOS)
Vulnerable versions: FortiOS builds storing admin credentials as SHA-256 salted hashes (pre-PBKDF2)
Fixed in: 7.4 (PBKDF2); 7.6 (PBKDF2); 8.0 (PBKDF2) - Fortinet — FortiOS SSL-VPN Gateway
Vulnerable versions: Internet-facing SSL-VPN without MFA and with reused/weak credentials
Fixed in: MFA-enforced configurations on 7.4 / 7.6 / 8.0
Remediation for FortiBleed — Credential Exposure Campaign Targeting Fortinet
Patches
- Upgrade FortiOS to 7.4, 7.6, or 8.0, which support PBKDF2 hashing of administrator credentials
- After upgrade, log in as each administrator to trigger re-hashing of credentials under PBKDF2 (SHA-256-salted hashes persist until manual login)
- Enforce strong credential storage with: set login-lockout-upon-weaker-encryption
Immediate actions
- Reset ALL FortiGate administrator and SSL-VPN account credentials immediately (assume all exposed credentials are compromised)
- Enforce strong, unique passwords and enable multi-factor authentication on all administrative and VPN accounts
- Check exposure using the Hudson Rock FortiBleed lookup tool (https://www.hudsonrock.com/fortinet), treating any match as confirmed compromise
- Restrict FortiGate management portal and SSL-VPN access to local/trusted networks and remove internet-facing management interfaces
- Audit for unexpected successful administrator logins, newly created accounts, and unauthorized configuration changes
Workarounds
- Disable internet-facing SSL-VPN and management access where not strictly required
- Geofence or IP-allowlist administrative access pending full credential rotation
- Monitor for suspicious admin account names: forticloud, fortiuser, fortinet-support, fortinet-tech-support
Longer-term hardening
- Deploy MFA universally for offline and remote access
- Remove unused or inactive accounts and enforce least privilege on management roles
- Continuously monitor authentication logs for anomalous source IPs and credential-stuffing patterns
- Block FortiBleed attacker infrastructure (85.11.187.0/24, AS211486) at the perimeter and monitor for AD enumeration/collection tooling
Weaknesses (CWE) in FortiBleed — Credential Exposure Campaign Targeting Fortinet
CWE-916, CWE-522, CWE-759, CWE-307, CWE-798
Timeline of FortiBleed — Credential Exposure Campaign Targeting Fortinet
- CVE-2018-13379 (FortiOS SSL-VPN path traversal) disclosed; later exploited in 2019 to leak ~500,000 Fortinet SSL-VPN credentials — the historical analogue to FortiBleed's credential-leak pattern.
- Attacker infrastructure at 85.11.187.8 (AS211486) observed serving HTTP on port 9999.
- Kevin Beaumont (DoublePulsar) and Hudson Rock corroborate the dataset; sampled administrative credentials confirmed authentic.
- Researcher Volodymyr 'Bob' Diachenko publicly discloses the FortiBleed dataset of valid FortiGate admin and SSL-VPN credentials.
- Attacker server (85.11.187.8) exhibits SSH, VNC, and RDP activity through 2026-06-15, consistent with hands-on operations.
- Recorded Future and PwnDefend publish corroborating analyses detailing the 45-GPU Hashtopolis cracking cluster and ~1.16B FortiGate / ~2.1B MSSQL credential attempts.
- Fortinet PSIRT publishes analysis confirming credential reuse + brute force (no new vulnerability), referencing prior advisories FG-IR-26-060 and FG-IR-25-647; recommends PBKDF2 upgrade and MFA.
- K7 Labs publishes consolidated FortiBleed security advisory; dataset reported at 73,900+ firewall URLs / 21,300+ domains across 194 countries.
Sources cited for FortiBleed — Credential Exposure Campaign Targeting Fortinet
- Security Advisory: FortiBleed Credential Exposure Campaign Targeting Fortinet Firewalls and VPN Gateways
- Analysis of Reported Credential Compromise of FortiGate Devices (Fortinet PSIRT)
- FortiBleed: 75k Fortinet firewalls have admin passwords cracked (Kevin Beaumont / DoublePulsar)
- Critical FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems (Recorded Future)
- FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices (BleepingComputer)
- FortiBleed Exposes Admin Passwords for 75,000 Fortinet Firewalls (Security Affairs)
- 74,000 Fortinet firewall credentials exposed in FortiBleed data leak (Help Net Security)
- Technical Advisory: FortiBleed Credential Exposure Campaign Targeting Internet-Facing Fortinet Devices (Bitdefender)
- Hudson Rock FortiBleed exposure lookup tool
- CVE-2018-13379 Detail (NVD) — historical FortiOS SSL-VPN path traversal credential leak
- Understanding the FortiOS critical vulnerability (FG-IR-25-647, FG-IR-26-060) upgrade prompt (Fortinet Community)
Threats related to FortiBleed — Credential Exposure Campaign Targeting Fortinet
- FortiBleed: Russian-Speaking Credential-Harvesting Campaign Against Internet-Exposed FortiGate Firewalls and SSL VPN Gateways
- FortiBleed Campaign: Custom FortigateSniffer Abuses FortiOS 'diagnose sniffer packet' to Harvest Credentials Across 24 Protocols
- FortiBleed: Russian Initial-Access-Broker Credential-Harvesting Campaign Weaponizing FortiGate Firewalls with the FortigateSniffer Tool
- FortiBleed: Mass Credential Compromise Campaign Against Internet-Exposed Fortinet FortiGate Devices (86,644 Devices, 194 Countries)
- FortiBleed Campaign: Mass FortiGate SSL VPN / Admin Credential Exposure Affecting ~73,932 Fortinet Firewalls Across 194 Countries
- FortiBleed Credential-Theft Campaign Linked to INC and Lynx Ransomware Operations
Detection coverage for TL-2026-0916
As of 2026-06-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0916 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0916
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.