# FortiBleed: Russian-Speaking Initial Access Broker Weaponizes FortiOS 'diagnose sniffer packet' (FortigateSniffer) to Harvest 110M+ Credentials From ~430,000 FortiGate Firewalls

> FortiBleed is an active, financially motivated credential-harvesting operation in which a Russian-speaking initial access broker (handle 'SantaAd') turns compromised internet-facing Fortinet FortiGate firewalls into passive credential collectors. After brute-forcing SSH/SSL-VPN admin access, the actor deploys FortigateSniffer, a Golang tool that abuses the built-in FortiOS 'diagnose sniffer packet' diagnostic to intercept authentication traffic across 24 protocols. SOCRadar reports ~430,000 targeted firewalls, 110M+ surfaced credentials across 659+ pipelines, and 86,644 confirmed working credentials spanning 194 countries — including a NATO-aligned defense contractor. The campaign relies on weak/harvested credentials and abuse of a legitimate feature, not a CVE or zero-day.

- **Published:** 2026-06-24T00:00:00Z
- **Last reviewed:** 2026-06-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0927
- **ID:** TL-2026-0927
- **Severity:** CRITICAL
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

FortiBleed is a large-scale, ongoing initial-access-broker (IAB) operation documented by the SOCRadar Threat Research Unit (STRU) and corroborated by Dark Reading, BleepingComputer, The Hacker News, SecurityWeek, Security Affairs, GBHackers, and CyberSecurityNews. It has been active since at least February 2026, with multi-vendor internet-wide scanning observed from 28 February 2026.

The operation is built around FortigateSniffer (also referenced as fg_sniffer / SNIFTRAN engine), a Golang implant that abuses the legitimate FortiOS diagnostic command 'diagnose sniffer packet'. Rather than exploiting a software vulnerability, the actor gains administrative access to internet-facing FortiGate devices (typically via SSH brute force, dictionary attacks, and SSL-VPN credential stuffing using a custom 'forticheck' utility running up to 25,000 threads), then runs the firewall's own packet sniffer to passively capture cleartext credentials and authentication hashes traversing the device. The sniffer monitors 24 protocols — including TACACS+, Kerberos, RADIUS, NTLM, RPC, SMB, LDAP, SMTP, FTP, Telnet, RDP, WinRM, MS-SQL, MySQL, and PostgreSQL — and applies geofencing/IP-range filters. It runs in 300-minute (5-hour) capture cycles with minute-by-minute status reporting, operating roughly 07:00–18:00 Moscow Time, with an initial validation success rate near 90%.

The five-stage attack chain is: (1) Reconnaissance with Masscan and Shodan, device fingerprinting via FortiProbe-fast, and revenue/economic-value-based target prioritization; (2) Initial access via SSH brute force and SSL-VPN credential stuffing (forticheck); (3) Deployment of FortigateSniffer (observed on ~6,127 devices) to passively harvest credentials across 24 protocols; (4) Distributed GPU hash cracking via a Hashtopolis-managed Hashcat cluster augmented with dynamically rented vast.ai capacity (1–6 GPUs), orchestrated through a Telegram bot (HASHBOT) delivering live cracking telemetry to a single hardcoded administrator, followed by Active Directory enumeration; (5) Exfiltration of DFS/SMB network shares and persistence via stolen/replayed session cookies.

Reported harvest volumes include ~14.8M RADIUS credentials, ~924,000 NTLM hashes, ~130,000 Kerberos hashes, and ~89M MySQL authentication tokens, totaling 110M+ credentials. SecurityWeek/CISA confirm 86,644 working credentials across 194 countries (~50% of internet-facing Fortinet firewalls by Shodan polling), with India and the United States accounting for roughly a third of entries; telecom, government, banking, healthcare, and universities are among affected sectors, weighted toward SMBs (~66% under 200 employees). A NATO-aligned defense contractor breach with data exfiltration was confirmed on 15 June 2026. Attribution to a Russian-speaking IAB is assessed at MEDIUM confidence based on Cyrillic comments in the tooling, Moscow-time operating windows, Eastern European micro-hoster infrastructure (Russian and Ukrainian networks), and an underground actor 'SantaAd' advertising Fortinet device access at $30,000–$60,000. CISA issued an urgent advisory (18 June 2026) urging organizations to terminate sessions, reset credentials, move admin password storage to PBKDF2, enable phishing-resistant MFA, and restrict management access.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.001 Scanning IP Blocks
- T1596 Search Open Technical Databases
- T1592 Gather Victim Host Information
- T1583.004 Server
- T1588.002 Tool
- T1587.001 Malware
- T1078 Valid Accounts
- T1133 External Remote Services
- T1110 Brute Force
- T1110.001 Password Guessing
- T1110.004 Credential Stuffing
- T1040 Network Sniffing
- T1557 Adversary-in-the-Middle
- T1056 Input Capture
- T1039 Data from Network Shared Drive
- T1087 Account Discovery
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1021.002 SMB/Windows Admin Shares
- T1021.001 Remote Desktop Protocol
- T1550.004 Web Session Cookie
- T1078 Valid Accounts
- T1102 Web Service
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service

## Sources

- [Dismantling FortiBleed: Inside a Russian Fortinet Compromise Operation (Whitepaper)](https://socradar.io/resources/whitepapers/dismantling-fortibleed-inside-a-russian-fortinet-compromise-operation/)
- [FortiBleed 2026: The Compromise of 86,644 Fortinet FortiGate Firewalls and Credential Leak](https://socradar.io/blog/fortibleed-fortinet-firewalls-compromised/)
- [FortiBleed Attackers Turn Firewalls Into Credentials Stealers](https://www.darkreading.com/cyberattacks-data-breaches/fortibleed-attackers-firewalls-credentials-stealers)
- [FortiBleed: 86,000 Fortinet Device Credentials Compromised](https://www.securityweek.com/fortibleed-86000-fortinet-device-credentials-compromised/)
- [FortiBleed campaign used custom FortiGate sniffer to steal credentials](https://www.bleepingcomputer.com/news/security/fortibleed-campaign-used-custom-fortigate-sniffer-to-steal-credentials/)
- [FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation](https://thehackernews.com/2026/06/fortibleed-targeted-fortigate-firewalls.html)
- [FortiBleed Campaign Uses FortigateSniffer to Harvest 110 Million Credentials From Fortinet Firewalls](https://gbhackers.com/fortibleed-campaign-uses-fortigatesniffer-to-harvest-110-million-credentials/)
- [FortiBleed: The Most Detailed Breakdown Yet of an Active Russian Credential-Harvesting Operation](https://securityaffairs.com/194004/hacking/fortibleed-the-most-detailed-breakdown-yet-of-an-active-russian-credential-harvesting-operation.html)
- [Hackers Using FortigateSniffer Tool That Turns Compromised Firewalls Into Password Collectors](https://cybersecuritynews.com/fortigatesniffer-tool-fortibleed/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0927