FortiBleed — Credential Exposure Campaign Targeting Fortinet FortiGate Firewalls and SSL-VPN Gateways

FortiBleed — Credential Exposure Campaign Targeting Fortinet (TL-2026-0916), also tracked as FortiBleed, is a critical-severity data breach, first published 2026-06-23. It carries a reported Russia nexus and is not formally attributed, affects Fortinet FortiGate Firewall (FortiOS), maps to 21 MITRE ATT&CK techniques (T1018, T1021, T1039), and is covered by 9 detection rules and 17 indicators of compromise.

Key facts for TL-2026-0916

Threat ID
TL-2026-0916
Also known as
FortiBleed
Severity
CRITICAL
Status
ACTIVE
Category
DATA_BREACH
First published
2026-06-23
Last reviewed
2026-06-23
Attribution confidence
NONE
Nation-state nexus
Russia
Motivation
FINANCIAL
Target sectors
government, telecommunications, financial, healthcare, manufacturing, critical infrastructure, defense
Target regions
Global, Asia, Europe, Middle East, North America
Detection rules
9
Indicators of compromise
17

Malware and tooling in FortiBleed — Credential Exposure Campaign Targeting Fortinet

Malware and tooling: Hashcat, Hashtopolis

FortiBleed is an active campaign in which a large dataset of valid Fortinet administrative and SSL-VPN credentials — covering ~73,932 FortiGate firewall URLs across 21,600+ domains in 194 countries — is being weaponized against internet-facing FortiGate devices. Credentials were recovered by offline GPU cracking of weak SHA-256-salted password hashes pulled from exported FortiGate configuration files, then reused for remote access and lateral movement. Fortinet PSIRT confirmed no new vulnerability or zero-day is involved.

How FortiBleed — Credential Exposure Campaign Targeting Fortinet works

FortiBleed is a credential-exposure and credential-harvesting campaign first publicly disclosed on 2026-06-13 by security researcher Volodymyr 'Bob' Diachenko and corroborated by Kevin Beaumont (DoublePulsar), Hudson Rock, and PwnDefend. The leaked dataset contains valid administrative and SSL-VPN credentials — usernames, email addresses, plaintext passwords, VPN credentials, and administrative access credentials — for approximately 73,932 unique internet-facing FortiGate firewall URLs spanning 21,600+ domains in 194 countries. Independent estimates place the affected population at roughly 50% of all internet-facing Fortinet firewalls (per Shodan polling), with later tallies reporting up to 86,644 devices.

Researchers assessed that the dataset originated from exported FortiGate configuration files rather than intercepted network traffic. FortiGate stores administrator passwords as SHA-256 hashes with a salt — a fast, weak hashing scheme — until an administrator manually logs in after upgrading to firmware that supports PBKDF2 (introduced in early-2025 builds). Attackers cracked these hashes offline using a 45-GPU cluster orchestrated via Hashtopolis/Hashcat, recovering plaintext credentials without needing ongoing access to the targeted devices. According to Diachenko's investigation, the operators conducted roughly 1.16 billion credential attempts against 320,777 FortiGate targets and approximately 2.1 billion credential attempts against 163,650 Microsoft SQL Server (MSSQL) systems. The exposed dataset also included a business-intelligence layer — company industry, revenue, employee count, and formatted broker-style comments — typical of criminal initial-access markets.

The recovered credentials enable attackers to authenticate to FortiGate management portals and SSL-VPN gateways, change security controls, create backdoor administrator accounts, and pivot into internal networks. Attacker tooling discovered in an exposed directory included Hashtopolis orchestration (bot.py, hashpanel.log, setup files), Active Directory enumeration and audit scripts (ad_enum.py, ad_full_audit.py), password-spraying utilities, and SMB/DFS collection scripts with exfiltration capability, alongside log-clearing markers indicating deliberate evidence removal. Attacker infrastructure was tied to 85.11.187.8 within AS211486 (85.11.187.0/24), observed serving HTTP on port 9999 (2026-06-07) and exhibiting SSH/VNC/RDP activity (2026-06-14 to 2026-06-15). Named or reported victims include organizations in Japan, Taiwan, Vietnam, Iraq, and Türkiye — among them a Turkish NATO defense contractor from which classified documents were allegedly exfiltrated — and the dataset references large enterprises across government, telecommunications, financial services, healthcare, manufacturing, and critical infrastructure.

Fortinet PSIRT (advisory published 2026-06-19, referencing prior advisories FG-IR-26-060 and FG-IR-25-647) confirmed the activity is credential reuse from prior incidents combined with brute-force techniques against devices with weak password hygiene and no multi-factor authentication — explicitly not a new vulnerability or zero-day. Because there is no software flaw to patch, remediation depends on credential rotation, MFA, firmware upgrade to versions that store admin credentials with PBKDF2 (7.4 / 7.6 / 8.0), and removal of internet-facing management exposure. Researchers note the underlying pattern echoes the 2019 mass leak of ~500,000 Fortinet SSL-VPN credentials harvested via CVE-2018-13379, and that the original config-file acquisition vector for some devices may trace to known or undisclosed FortiOS vulnerabilities.

MITRE ATT&CK techniques used in TL-2026-0916

Discovery

T1018 Remote System Discovery; T1046 Network Service Discovery; T1087 Account Discovery

Lateral Movement

T1021 Remote Services

Collection

T1039 Data from Network Shared Drive

Credential Access

T1040 Network Sniffing; T1110 Brute Force; T1552 Unsecured Credentials

Exfiltration

T1041 Exfiltration Over C2 Channel

Defense Evasion

T1070 Indicator Removal

Command and Control

T1071 Application Layer Protocol

Initial Access

T1078 Valid Accounts; T1133 External Remote Services

Persistence

T1098 Account Manipulation; T1136 Create Account

defense-impairment

T1556 Modify Authentication Process

Resource Development

T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1588 Obtain Capabilities

Reconnaissance

T1589 Gather Victim Identity Information; T1595 Active Scanning

Affected products and versions in FortiBleed — Credential Exposure Campaign Targeting Fortinet

  • Fortinet — FortiGate Firewall (FortiOS)
    Vulnerable versions: FortiOS builds storing admin credentials as SHA-256 salted hashes (pre-PBKDF2)
    Fixed in: 7.4 (PBKDF2); 7.6 (PBKDF2); 8.0 (PBKDF2)
  • Fortinet — FortiOS SSL-VPN Gateway
    Vulnerable versions: Internet-facing SSL-VPN without MFA and with reused/weak credentials
    Fixed in: MFA-enforced configurations on 7.4 / 7.6 / 8.0

Remediation for FortiBleed — Credential Exposure Campaign Targeting Fortinet

Patches

  • Upgrade FortiOS to 7.4, 7.6, or 8.0, which support PBKDF2 hashing of administrator credentials
  • After upgrade, log in as each administrator to trigger re-hashing of credentials under PBKDF2 (SHA-256-salted hashes persist until manual login)
  • Enforce strong credential storage with: set login-lockout-upon-weaker-encryption

Immediate actions

  • Reset ALL FortiGate administrator and SSL-VPN account credentials immediately (assume all exposed credentials are compromised)
  • Enforce strong, unique passwords and enable multi-factor authentication on all administrative and VPN accounts
  • Check exposure using the Hudson Rock FortiBleed lookup tool (https://www.hudsonrock.com/fortinet), treating any match as confirmed compromise
  • Restrict FortiGate management portal and SSL-VPN access to local/trusted networks and remove internet-facing management interfaces
  • Audit for unexpected successful administrator logins, newly created accounts, and unauthorized configuration changes

Workarounds

  • Disable internet-facing SSL-VPN and management access where not strictly required
  • Geofence or IP-allowlist administrative access pending full credential rotation
  • Monitor for suspicious admin account names: forticloud, fortiuser, fortinet-support, fortinet-tech-support

Longer-term hardening

  • Deploy MFA universally for offline and remote access
  • Remove unused or inactive accounts and enforce least privilege on management roles
  • Continuously monitor authentication logs for anomalous source IPs and credential-stuffing patterns
  • Block FortiBleed attacker infrastructure (85.11.187.0/24, AS211486) at the perimeter and monitor for AD enumeration/collection tooling

Weaknesses (CWE) in FortiBleed — Credential Exposure Campaign Targeting Fortinet

CWE-916, CWE-522, CWE-759, CWE-307, CWE-798

Timeline of FortiBleed — Credential Exposure Campaign Targeting Fortinet

  • CVE-2018-13379 (FortiOS SSL-VPN path traversal) disclosed; later exploited in 2019 to leak ~500,000 Fortinet SSL-VPN credentials — the historical analogue to FortiBleed's credential-leak pattern.
  • Attacker infrastructure at 85.11.187.8 (AS211486) observed serving HTTP on port 9999.
  • Kevin Beaumont (DoublePulsar) and Hudson Rock corroborate the dataset; sampled administrative credentials confirmed authentic.
  • Researcher Volodymyr 'Bob' Diachenko publicly discloses the FortiBleed dataset of valid FortiGate admin and SSL-VPN credentials.
  • Attacker server (85.11.187.8) exhibits SSH, VNC, and RDP activity through 2026-06-15, consistent with hands-on operations.
  • Recorded Future and PwnDefend publish corroborating analyses detailing the 45-GPU Hashtopolis cracking cluster and ~1.16B FortiGate / ~2.1B MSSQL credential attempts.
  • Fortinet PSIRT publishes analysis confirming credential reuse + brute force (no new vulnerability), referencing prior advisories FG-IR-26-060 and FG-IR-25-647; recommends PBKDF2 upgrade and MFA.
  • K7 Labs publishes consolidated FortiBleed security advisory; dataset reported at 73,900+ firewall URLs / 21,300+ domains across 194 countries.

Sources cited for FortiBleed — Credential Exposure Campaign Targeting Fortinet

Threats related to FortiBleed — Credential Exposure Campaign Targeting Fortinet

Detection coverage for TL-2026-0916

As of 2026-06-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0916 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-0916

2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats