FortiBleed Credential Theft Campaign: FortigateSniffer Tool Deployed Against 430,000+ FortiGate Firewalls, Linked to INC Ransom and Lynx Ransomware
FortiBleed Credential Theft Campaign (TL-2026-1124), also tracked as FortiBleed, is a critical-severity ransomware operation, first published 2026-07-01. It is attributed to INC Ransom (Russia) with medium confidence, affects Fortinet FortiGate / FortiOS, references 3 CVEs (CVE-2022-40684, CVE-2023-27997, CVE-2024-21762), maps to 33 MITRE ATT&CK techniques (T1005, T1018, T1021), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-1124
- Threat ID
- TL-2026-1124
- Also known as
- FortiBleed, FortiGate Sniffer Campaign
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-07-01
- Last reviewed
- 2026-07-01
- Attribution
- INC Ransom
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- government administration, telecoms, financial services, health, manufacturing, technology, energy, transportation and logistics, agriculture, defense industrial base
- Target regions
- Global (194 countries), North America, Europe, Asia-Pacific, india, united states of america
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in FortiBleed Credential Theft Campaign
Malware and tooling: Lynx, inc ransom, Cobalt Strike, FortigateSniffer, Hashtopolis
A Russian-speaking initial access broker ran a large-scale credential-harvesting operation dubbed 'FortiBleed' that combined reused credentials, mass brute-force, and a custom Golang packet-sniffing tool (FortigateSniffer) abusing FortiOS's native 'diagnose sniffer packet' command to intercept VPN and directory-service credentials from over 430,000 internet-facing FortiGate firewalls. SOCRadar's Threat Research Unit confirmed an operator with access to the FortiBleed infrastructure was simultaneously logged into the negotiation panels of INC Ransom and Lynx ransomware, the first confirmed pipeline from mass firewall credential theft to ransomware deployment.
How FortiBleed Credential Theft Campaign works
FortiBleed is an operational credential-theft campaign, not a single CVE. Security researcher Volodymyr "Bob" Diachenko first identified the operation on 2026-06-13 after discovering a publicly exposed threat-actor server hosting a structured database of validated FortiGate administrator and VPN credentials alongside the group's attack tooling. Within 48 hours, Recorded Future, Field Effect, SOCRadar, Hudson Rock, Bitsight, and Arctic Wolf independently validated portions of the dataset, and by 2026-06-19 the confirmed tally of devices with verified working credentials had grown to 86,644 across 194 countries. Fortinet's PSIRT publicly stated the activity is 'not a new Fortinet vulnerability,' attributing it instead to credential reuse tied to prior advisories FG-IR-26-060 and FG-IR-25-647, combined with brute-force attacks against devices lacking strong passwords and MFA. Independent researchers additionally note that a meaningful share of the original leaked configuration files plausibly trace back to historically exploited FortiOS SSL-VPN/administrative-interface flaws -- CVE-2022-40684 (authentication bypass), CVE-2023-27997 'XORtigate' (heap buffer overflow), and CVE-2024-21762 (SSL VPN out-of-bounds write) -- all of which allowed unauthenticated attackers to pull FortiGate configuration files (and thus stored credential hashes) from unpatched, internet-facing devices in prior exploitation waves dating back to 2022.
Once credentials were reused or brute-forced onto a device (SSH brute-force with 16 wordlists and SSL-VPN credential stuffing at up to 25,000 threads yielded 237,330 valid credentials in one tracked pipeline), operators deployed FortigateSniffer, a Golang binary compiled for both Linux and Windows with an entirely Russian-language interface. The tool abuses the legitimate FortiOS diagnostic command 'diagnose sniffer packet' to passively capture authentication traffic across roughly two dozen protocols -- Kerberos, RADIUS, NTLM, RDP, LDAP, MSSQL, SMB, FTP, Telnet, and WinRM among them -- without dropping any traditional malware on the appliance. Captured SSH terminal output is converted to .pcapng via an internal 'SNIFTRAN' conversion engine and processed through a 'PCAP Deep Analysis Toolkit (v5.0)' that extracts cleartext credentials, NTLM hashes, Kerberos tickets, and session cookies. To minimize detection, the sniffer only runs 07:00-18:00 Moscow Time and applies GeoIP-based filtering via a binary-search-optimized ipgeo.csv allow/deny list, blending malicious capture windows into normal business-hours traffic patterns.
A compounding weakness is FortiGate's legacy SHA-256-with-salt admin credential hashing, which is comparatively crack-friendly versus the PBKDF2 hashing introduced in FortiOS 7.2.11, 7.4.8, and 7.6.1; critically, upgrading FortiOS alone does not rehash an existing admin's password to PBKDF2 until that admin logs in again post-upgrade, leaving legacy hashes crackable indefinitely on unrefreshed accounts. Operators ran offline cracking on a 45-node Hashtopolis/Hashcat GPU cluster, dynamically renting additional compute from vast.ai and orchestrating cracking jobs through a Telegram bot. An internal tracking document recovered from one of roughly 200-500 operational servers revealed an organized structure of about 20 people with defined roles: a small core of primary operators driving high-impact intrusions, dedicated technical specialists, and a back-office layer of junior operators. Post-compromise activity included creation of persistent backdoor admin accounts (observed names: adminin, support, ssl-admin, svc_monitor, forticloud, fortiuser, fortinet-support, fortinet-tech-support), Kerberoasting and RC4 ticket cracking for lateral movement, and staged exfiltration of DFS backup shares -- including a confirmed 2026-06-15 exfiltration event against a NATO-affiliated defense contractor.
SOCRadar's whitepaper 'Dismantling FortiBleed' establishes that campaign infrastructure produced 409 targets with confirmed administrative access, 354 full domain compromises, and at least 12 confirmed ransomware deployments. Crucially, one operator with access to FortiBleed's back-end infrastructure was found actively logged into the negotiation panels of both INC Ransom (active since mid-2023) and Lynx (emerged mid-2024 and widely assessed to be an INC rebrand sharing substantial source code), with victims listed on INC Ransom's leak site overlapping directly with FortiBleed's victim dataset. This is the first confirmed operational link tying mass FortiGate credential theft directly to ransomware-as-a-service deployment, rather than opportunistic reuse by an unrelated actor. Both ransomware families follow a double-extortion model: INC Ransom uses Rust-rewritten Windows/Linux/ESXi encryptors (.inc extension, INC-README.txt/.html notes) with Cobalt Strike, PsExec, WinPEAS, and Mimikatz for lateral movement and privilege escalation; Lynx encrypts with AES-128-CTR plus Curve25519 Donna (.lynx extension), terminates backup/database/mail-server processes (MSSQL, Veeam, Exchange), deletes Volume Shadow Copies, and delivers ransom notes via desktop wallpaper changes and networked-printer output, directing victims to a Tor negotiation portal and the clearnet leak site lynxblog[.]net.
MITRE ATT&CK techniques used in TL-2026-1124
Collection
T1005 Data from Local System; T1074 Data Staged; T1560 Archive Collected Data
Discovery
T1018 Remote System Discovery; T1069 Permission Groups Discovery; T1087 Account Discovery
Lateral Movement
T1021 Remote Services; T1570 Lateral Tool Transfer
Credential Access
T1040 Network Sniffing; T1110 Brute Force; T1187 Forced Authentication; T1212 Exploitation for Credential Access; T1552 Unsecured Credentials; T1555 Credentials from Password Stores; T1558 Steal or Forge Kerberos Tickets
Exfiltration
T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Privilege Escalation
Defense Evasion
Command and Control
T1090 Proxy; T1102 Web Service
Persistence
T1098 Account Manipulation; T1136 Create Account
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery
Resource Development
T1583 Acquire Infrastructure; T1588 Obtain Capabilities
Reconnaissance
T1591 Gather Victim Org Information; T1595 Active Scanning; T1596 Search Open Technical Databases
Affected products and versions in FortiBleed Credential Theft Campaign
- Fortinet — FortiGate / FortiOS
Vulnerable versions: Internet-facing FortiGate devices with SSL VPN or admin HTTPS/SSH exposed to the public internet; FortiOS builds prior to 7.2.11 / 7.4.8 / 7.6.1 (SHA-256 admin credential hashing); Devices previously affected by CVE-2022-40684, CVE-2023-27997, or CVE-2024-21762 that were patched but never had credentials rotated afterward; Devices with default, reused, or weak admin/VPN credentials and no MFA enabled
Fixed in: FortiOS 7.2.11+, 7.4.8+, 7.6.1+ with PBKDF2 credential hashing (requires admin re-authentication to force rehash); Current FortiOS 7.4, 7.6, or 8.0 branches per CISA 2026-06-18 guidance - Fortinet — FortiProxy
Vulnerable versions: FortiProxy versions affected by CVE-2022-40684 and CVE-2024-21762
Fixed in: Vendor-patched FortiProxy releases per FG-IR advisories
Remediation for FortiBleed Credential Theft Campaign
Patches
- Upgrade to FortiOS 7.2.11, 7.4.8, or 7.6.1 or later to adopt PBKDF2 admin credential hashing
- Upgrade to the current FortiOS 7.4, 7.6, or 8.0 branches per CISA's 2026-06-18 guidance
- Apply patches for CVE-2022-40684, CVE-2023-27997, and CVE-2024-21762 on any device that has not already been remediated for these historically exploited FortiOS SSL-VPN/admin-interface flaws
Immediate actions
- Terminate all active SSL VPN and administrative sessions on internet-facing FortiGate devices
- Reset all FortiGate VPN and administrative passwords immediately across the entire estate
- Hunt for and remove unauthorized backdoor admin accounts (adminin, support, ssl-admin, svc_monitor, forticloud, fortiuser, fortinet-support, fortinet-tech-support)
- Restrict or remove FortiGate management interfaces (HTTPS admin, SSH) from public internet exposure
- Audit and revoke API user tokens tied to admin accounts, since tokens survive password resets and do not get invalidated by a password change alone
Workarounds
- Disable or tightly IP-allowlist SSL VPN and administrative HTTPS access from the internet
- Rotate SSH host keys and review authorized_keys / admin trustedhost configuration on exposed appliances
- Cross-reference FortiGate admin account lists against known FortiBleed backdoor account naming patterns
Longer-term hardening
- Enforce phishing-resistant multi-factor authentication on all administrator and VPN user accounts
- Force PBKDF2 credential re-hash by requiring every admin account to re-authenticate after the FortiOS upgrade, since upgrading alone leaves existing SHA-256 hashes in place until next login
- Segment and continuously monitor management-plane network access to FortiGate appliances
- Enable centralized logging and alerting for 'diagnose sniffer' and other diagnostic CLI command usage on all FortiGate devices
- Deploy detections for anomalous Kerberos/NTLM/RADIUS authentication capture patterns and for SSH/SSL-VPN brute-force and credential-stuffing traffic
CVEs associated with FortiBleed Credential Theft Campaign
Weaknesses (CWE) in FortiBleed Credential Theft Campaign
CWE-287, CWE-122, CWE-787, CWE-522, CWE-798
Timeline of FortiBleed Credential Theft Campaign
- Earliest identified FortiBleed activity: Russian-speaking IAB begins mass scanning (Masscan/Shodan) and credential-reuse/brute-force attacks against internet-facing FortiGate firewalls, the first of 659 tracked harvest cycles.
- Security researcher Volodymyr 'Bob' Diachenko discovers a publicly exposed threat-actor server hosting a structured database of validated FortiGate credentials plus attack tooling, and publicly attributes the campaign to a Russian-speaking group.
- Operators conduct a targeted DFS backup share exfiltration against a NATO-affiliated defense contractor following successful Kerberos RC4 ticket cracking.
- CISA issues an emergency advisory mandating FortiGate session termination, password resets, and MFA enforcement; the UK NCSC publishes a parallel global warning.
- Fortinet PSIRT publishes a blog stating the activity is not a new Fortinet vulnerability, attributing it to credential reuse and brute force; confirmed compromised-device tally reaches 86,644 across 194 countries.
- FortiBleed infrastructure is formally connected to the Lynx-INC ransomware cluster following analysis of a recovered internal tracking document.
- A newly recovered internal document adds 9,426 additional compromised FortiGate devices to the tracked total; ransomware has already been deployed against several overlapping victims.
- SOCRadar's Threat Research Unit publishes 'Dismantling FortiBleed,' confirming 430,000+ targeted firewalls, 110+ million harvested credentials, 354 full domain compromises, at least 12 ransomware deployments, and an operator found simultaneously logged into both INC Ransom and Lynx negotiation panels.
Sources cited for FortiBleed Credential Theft Campaign
- FortiBleed credential-theft campaign linked to Lynx ransomware
- FortiBleed campaign used custom FortiGate sniffer to steal credentials
- CISA warns Fortinet users to secure devices after FortiBleed leak
- SOCRadar Links FortiBleed Campaign to INC and Lynx Ransomware Operations
- Dismantling FortiBleed: Inside a Russian Fortinet Compromise Operation
- FortiBleed: 86,644 Fortinet Firewalls Compromised — SOCRadar Research
- FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations
- FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation
- Hackers Using FortigateSniffer Tool That Turns Compromised Firewalls Into Password Collectors
- FortiBleed: Inside the Campaign That Cracked 75,000 Fortinet Firewalls
- CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure
- Analysis of Reported Credential Compromise of FortiGate Devices
- FortiBleed: 86,000 Fortinet Device Credentials Compromised
- 430,000 FortiGate Devices Exposed in FortiBleed Ransomware Link
- Lynx Ransomware: A Rebranding of INC Ransomware
Threats related to FortiBleed Credential Theft Campaign
- FortiBleed Credential Theft Campaign Linked to INC and Lynx Ransomware Operations
- FortiBleed: Mass Credential Compromise Campaign Against Internet-Exposed Fortinet FortiGate Devices (86,644 Devices, 194 Countries)
- FortiBleed: Russian-Speaking Credential-Harvesting Campaign Against Internet-Exposed FortiGate Firewalls and SSL VPN Gateways
- FortiBleed Credential-Theft Campaign Linked to INC and Lynx Ransomware Operations
- FortiBleed: Russian Initial-Access-Broker Credential-Harvesting Campaign Weaponizing FortiGate Firewalls with the FortigateSniffer Tool
- FortiBleed Campaign: Custom FortigateSniffer Abuses FortiOS 'diagnose sniffer packet' to Harvest Credentials Across 24 Protocols
Detection coverage for TL-2026-1124
As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1124 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1124
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.