# FortiBleed: Russian Initial-Access-Broker Credential-Harvesting Campaign Weaponizing FortiGate Firewalls with the FortigateSniffer Tool

> FortiBleed is an active, financially motivated credential-harvesting operation in which a Russian-aligned initial access broker turned internet-exposed FortiGate firewalls and SSL VPN gateways into passive surveillance points. A custom Go tool (FortigateSniffer / harvest_orig) abuses the FortiOS 'diagnose sniffer packet' command to capture authentication traffic across 24 protocols; captured hashes are cracked on a Vast.ai-rented GPU cluster managed via Hashtopolis/Hashcat and orchestrated through a Telegram bot.

- **Published:** 2026-06-23T00:00:00Z
- **Last reviewed:** 2026-06-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0918
- **ID:** TL-2026-0918
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** FortiBleed operator (Russia)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

FortiBleed is a large-scale, ongoing credential-compromise campaign against Fortinet FortiGate firewalls and SSL VPN gateways, first named publicly in mid-June 2026 after an attacker staging server was found exposed. The operator profile is consistent with a Russian-origin initial access broker (IAB) selling access to ransomware affiliates: tooling carries Cyrillic-language comments and the harvesting component only runs between 07:00 and 18:00 Moscow Time to blend with business-hours traffic.

Initial access is achieved by mass-scanning the internet (Masscan / custom Shodan_Recon / FortiProbe-fast) for FortiGate devices with exposed management interfaces, then authenticating with credentials sourced from prior Fortinet leaks and infostealer logs, or recovered by brute-force and GPU hash-cracking. Wordlists are curated for FortiGate admin naming conventions. Once a device is reached, the actor abuses the legitimate FortiOS diagnostic capability 'diagnose sniffer packet' via a Golang harvester (filename harvest_orig, a ~4.3 MB static ELF; a Windows/amd64 scanner variant also exists) to passively intercept authentication material for 24 protocols including NTLMv1/NTLMv2, Kerberos RC4/AES pre-auth, AS-REP, Kerberoast, HTTP Basic/Form/JSON, LDAP, MSSQL, MySQL, PostgreSQL, RADIUS, SNMP, RDP, WinRM, SSH, FTP, Telnet, SMTP, IMAP, POP3, and cleartext tokens/cookies. Captured hashes are exfiltrated to a Hashtopolis 0.7.2 server (observed on 85.11.187.8:8443) and cracked with Hashcat across a pool of ~10 RTX 4090 GPUs rented from Vast.ai, with a 4,525-line Telegram bot (bot.py / 'Telegram Hashcat Bot, NetNTLMv2 Cracker v10') providing live telemetry to a single hardcoded administrator.

For persistence the actor plants rogue administrator accounts on thousands of devices using names that masquerade as Fortinet services (forticloud-sync, forticloud-tech, support_fortinet, Technical_support, fortinetadmin, tech-fortinet, fgtsecure, fgtsec); the most frequent planted credential pairs include adminin:ITAdmin@888 (~3,947 devices), fortiAdmin:fortiAdmin1qaz2wsx (~1,282 devices) and fgtsecure:F0rt!n3tS3cur3! (~1,152 devices). Post-exploitation pivots through OpenFortiVPN client configs (vpn5.conf) and an Impacket-based toolkit (ad_full_audit.py, spray_da.py, spray_taroko.py, spider.py) to reach Active Directory, password-spray domain accounts, and recursively spider network shares; an autonomous AI pentest agent named CyberStrike automates parts of the chain. Anti-forensic options (delete_txt, delete_pcapng) remove capture artifacts. Reported scale spans 73,932+ firewall URLs across 194 countries, ~21,632 affected domains, 110M+ harvested credentials, ~21,976 devices with confirmed administrative access (the majority via SSH/22), 623 domains showing AD-compromise evidence, and a confirmed breach of a NATO-aligned defense contractor. No CVE is assigned; the campaign exploits exposed management surfaces, weak/reused credentials, and missing MFA rather than a single software flaw.

## MITRE ATT&CK

- T1595 Active Scanning
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1586 Compromise Accounts
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1110 Brute Force
- T1040 Network Sniffing
- T1557 Adversary-in-the-Middle
- T1558 Steal or Forge Kerberos Tickets
- T1136 Create Account
- T1098 Account Manipulation
- T1070 Indicator Removal
- T1548 Abuse Elevation Control Mechanism
- T1087 Account Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1039 Data from Network Shared Drive
- T1557 Adversary-in-the-Middle
- T1102 Web Service
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel

## Sources

- [FortiBleed: investigation and remediation](https://www.helpnetsecurity.com/2026/06/23/fortibleed-investigation-remediation/)
- [FortiBleed: The Most Detailed Breakdown Yet of an Active Russian Credential-Harvesting Operation](https://securityaffairs.com/194004/hacking/fortibleed-the-most-detailed-breakdown-yet-of-an-active-russian-credential-harvesting-operation.html)
- [Critical FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems (Insikt Group)](https://www.recordedfuture.com/blog/critical-fortibleed-campaign)
- [Fortibleed: Anatomy of the FortiBleed campaign based on the server the attackers left exposed](https://zenox.ai/en/fortibleed-anatomy-of-the-fortibleed-campaign-based-on-the-server-that-the-attackers-themselves-left-exposed/)
- [FortiBleed 2026: The Compromise of 86,644 Fortinet FortiGate Firewalls and Credential Leak (SOCRadar)](https://socradar.io/blog/fortibleed-fortinet-firewalls-compromised/)
- [Dismantling FortiBleed: Inside a Russian Fortinet Compromise Operation (SOCRadar STRU whitepaper)](https://socradar.io/resources/whitepapers/dismantling-fortibleed-inside-a-russian-fortinet-compromise-operation/)
- [FortiBleed campaign used custom FortiGate sniffer to steal credentials](https://www.bleepingcomputer.com/news/security/fortibleed-campaign-used-custom-fortigate-sniffer-to-steal-credentials/)
- [FortiBleed Attackers Turn Firewalls Into Credential Stealers](https://www.darkreading.com/cyberattacks-data-breaches/fortibleed-attackers-firewalls-credentials-stealers)
- [Russian Initial Access Broker Behind FortiBleed Campaign](https://www.securityweek.com/russian-initial-access-broker-behind-fortibleed-campaign/)
- [Technical Advisory: FortiBleed Credential Exposure Campaign Targeting Internet-Facing Fortinet Devices (Bitdefender)](https://businessinsights.bitdefender.com/technical-advisory-fortibleed-credential-exposure-campaign-targeting-internet-facing-fortinet-devices)
- [FortiBleed: Analysis of a Global Access Broker Campaign (SpyCloud)](https://spycloud.com/blog/what-spycloud-found-inside-the-fortibleed-threat-actor-infrastructure/)
- [FortiBleed Campaign Uses FortigateSniffer to Harvest 110 Million Credentials From Fortinet Firewalls](https://gbhackers.com/fortibleed-campaign-uses-fortigatesniffer-to-harvest-110-million-credentials/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0918