# FortiBleed: Mass Credential Compromise Campaign Against Internet-Exposed Fortinet FortiGate Devices (86,644 Devices, 194 Countries)

> FortiBleed is an active, self-sustaining credential-harvesting campaign against internet-exposed Fortinet FortiGate SSL VPN and management interfaces. Threat actors extract configuration files, crack legacy SHA-256 admin password hashes, and continuously revalidate a growing database of working credentials — harvesting confirmed working admin credentials for an estimated 86,644 devices across 194 countries (roughly half of all internet-facing Fortinet firewalls). Activity has been tentatively attributed to the Lynx/INC Ransom group and overlaps with active exploitation of Fortinet FortiCloud SSO authentication-bypass vulnerabilities (CVE-2026-24858, CVE-2025-59718, CVE-2025-59719).

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-08-31T11:42:48.294Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1232
- **ID:** TL-2026-1232
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** CAMPAIGN
- **Status:** ACTIVE
- **Actor:** Lynx (Russia)
- **Detections:** 9 · **IOCs:** 89 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-24858, CVE-2025-59718, CVE-2025-59719, CVE-2018-13379, CVE-2022-42475, CVE-2023-27997, CVE-2024-21762, CVE-2024-55591, CVE-2026-25815, CVE-2022-40684, CVE-2024-23113, CVE-2023-48788, CVE-2022-41328, CVE-2025-68686

## Description

FortiBleed is a large-scale, ongoing credential compromise campaign targeting internet-exposed Fortinet FortiGate devices' SSL VPN and administrative management interfaces, reachable on standard (443) and non-standard (4443, 8443, 10443) HTTPS ports. First identified by security researchers in mid-June 2026 (Wiz Threat Center, Arctic Wolf Labs, SOCRadar) and running since at least February 2026, the campaign is not driven by a single zero-day but by systemic weak credential hygiene compounded by a legacy password-storage weakness in FortiOS.

Fortinet introduced PBKDF2-based password hashing for administrator credentials in FortiOS 7.2.11, 7.4.8, and 7.6.1, replacing a legacy SHA-256-based storage mechanism. Critically, when a device is upgraded from an earlier version, existing administrator passwords remain stored as SHA-256 hashes until the corresponding administrator successfully logs in following the upgrade — leaving a large population of upgraded-but-not-re-authenticated devices with crackable legacy hashes. Threat actors have been systematically extracting configuration files from internet-facing FortiGate devices (via exposed management interfaces, prior breach access, or leaked backups) and cracking the stored SHA-256 hashes offline, then combining the results with credentials harvested from earlier Fortinet-related breach dumps and infostealer logs.

The resulting credential database is continuously revalidated against internet-facing FortiGate devices via automated authentication attempts. Once a device is compromised, it is frequently repurposed as a listening post to passively monitor SSL VPN traffic, harvesting additional live credentials that feed back into the scanner — creating a self-sustaining feedback loop that has driven the campaign's scale. Investigators identified a large fraction of compromised accounts as generic administrative or Fortinet built-in system accounts (e.g., 'admin' variants ~21.4%, 'fgts*' system accounts ~6.95%, 'fort*' system accounts ~5.4-6%, 'telm*' ISP-provisioned accounts ~2.36%), and Fortinet's own PSIRT analysis separately flagged suspicious admin account names to monitor for: forticloud, fortiuser, fortinet-support, fortinet-tech-support.

The campaign closely tracks — and in reporting is frequently conflated/overlapped with — active in-the-wild exploitation of a cluster of Fortinet FortiCloud SSO authentication-bypass vulnerabilities: CVE-2025-59718 and CVE-2025-59719 (improper verification of cryptographic signature in FortiCloud SSO SAML handling, CVSS 9.8/9.1 depending on source, disclosed December 2025, added to CISA KEV December 16 2025) and CVE-2026-24858 (authentication bypass allowing a FortiCloud account holder to authenticate to devices registered under other FortiCloud accounts when SSO is enabled, CVSS 9.8, CWE-288, disclosed January 27 2026, added to CISA KEV the same day). Fortinet observed two malicious FortiCloud accounts actively exploiting CVE-2026-24858 in the wild before locking them out on 2026-01-22, and disabled FortiCloud SSO server-side on 2026-01-26. Both advisory families (FG-IR-25-647 and FG-IR-26-060) are explicitly referenced in Fortinet's own PSIRT analysis of the FortiBleed credential compromise as related, actively-exploited authentication weaknesses in the same feature surface (FortiCloud SSO / admin authentication).

Attribution work by SOCRadar (published June 29, 2026) tentatively links the campaign's infrastructure, tooling choices, and victim-selection patterns to the Lynx/INC Ransom group (also tracked as INC Ransomware), a Russian-speaking ransomware-as-a-service operation active since 2023 with a documented focus on NATO member states and adjacent countries. Analysts noted that defense-industry VPN endpoint credentials were recovered from an exposed operator server, and that the operation's server infrastructure (260+ operational servers, 80,000+ unique IPs, 22,405+ unique domains observed) is organized by country, sector, and victim organization revenue — consistent with pre-ransomware initial-access broker tradecraft rather than opportunistic credential stuffing alone.

Confirmed and probable victims span government (591 entries across 111 domains, ~60% India), telecommunications (5,616 entries, the most-targeted vertical), healthcare, education, energy, banking, manufacturing, universities, and large commercial enterprises (>20% of entries from organizations with >$1B revenue), with primary geographic concentration in North America and Europe alongside global (194-country) reach. CISA issued a public alert (2026-06-18) urging organizations to harden internet-facing Fortinet devices in direct response to the campaign, and multiple national CERTs (including cyber.gc.ca) have separately issued guidance on the related FortiCloud SSO CVEs.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1595 Active Scanning
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1110 Brute Force
- T1552 Unsecured Credentials
- T1040 Network Sniffing
- T1212 Exploitation for Credential Access
- T1557 Adversary-in-the-Middle
- T1556 Modify Authentication Process
- T1136 Create Account
- T1087 Account Discovery
- T1046 Network Service Discovery
- T1039 Data from Network Shared Drive
- T1090 Proxy
- T1531 Account Access Removal
- T1595.001 Active Scanning: Scanning IP Blocks
- T1583.008 Acquire Infrastructure: Malvertising
- T1585 Establish Accounts
- T1110.003 Brute Force: Password Spraying
- T1018 Remote System Discovery
- T1602.002 Data from Configuration Repository: Network Device Configuration Dump
- T1095 Non-Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1498 Network Denial of Service
- T1686 Disable or Modify System Firewall
- T1592 Gather Victim Host Information
- T1583.004 Acquire Infrastructure: Server
- T1588.002 Obtain Capabilities: Tool
- T1586 Compromise Accounts
- T1059 Command and Scripting Interpreter
- T1098 Account Manipulation
- T1070.003 Indicator Removal: Clear Command History
- T1685.002 Disable or Modify Cloud Log
- T1539 Steal Web Session Cookie
- T1087.002 Account Discovery: Domain Account
- T1016 System Network Configuration Discovery

## Sources

- [FortiBleed: Credential Compromise Campaign Targeting Fortinet Devices](https://threats.wiz.io/all-incidents/fortibleed-credential-compromise-campaign-targeting-fortinet-devices)
- [Analysis of reported credential compromise of FortiGate devices](https://www.fortinet.com/blog/psirt-blogs/analysis-of-reported-credential-compromise-of-fortigate-devices)
- [Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries](https://arcticwolf.com/resources/blog/active-fortibleed-campaign-impacting-fortinet-devices-across-194-countries/)
- [FortiBleed: 86,644 Fortinet Firewalls Compromised — SOCRadar Research](https://socradar.io/blog/fortibleed-fortinet-firewalls-compromised/)
- [FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems](https://www.recordedfuture.com/blog/critical-fortibleed-campaign)
- [Technical Advisory: FortiBleed Credential Exposure Campaign Targeting Internet-Facing Fortinet Devices](https://businessinsights.bitdefender.com/technical-advisory-fortibleed-credential-exposure-campaign-targeting-internet-facing-fortinet-devices)
- [Global cybersecurity agencies warn of credential exposure in FortiBleed campaign targeting Fortinet firewalls, VPN gateways](https://industrialcyber.co/vulnerabilities/global-cybersecurity-agencies-warn-of-credential-exposure-in-fortibleed-campaign-targeting-fortinet-firewalls-vpn-gateways/)
- [FortiBleed: Default Credential Exploitation and Mass Fortinet Compromise](https://labs.cloudsecurityalliance.org/research/csa-research-note-fortibleed-default-credentials-20260620-cs/)
- [FortiBleed Security Alert: Fortinet VPN Credentials Exposed](https://www.bitsight.com/blog/security-alert-fortibleed-fortinet-vpn-credentials-firewall-exposed)
- [2026-June Fortibleed Credential Exposure – Huntress Support](https://support.huntress.io/hc/en-us/articles/52698652545171-2026-June-Fortibleed-Credential-Exposure)
- [CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure](https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-urges-hardening-fortinet-devices-after-reports-credential-exposure)
- [Fortinet Releases Guidance to Address Ongoing Exploitation of Authentication Bypass Vulnerability CVE-2026-24858](https://www.cisa.gov/news-events/alerts/2026/01/28/fortinet-releases-guidance-address-ongoing-exploitation-authentication-bypass-vulnerability-cve-2026)
- [Administrative FortiCloud SSO authentication bypass (FG-IR-26-060)](https://www.fortiguard.com/psirt/FG-IR-26-060)
- [Multiple Fortinet Products' FortiCloud SSO Login Authentication Bypass (FG-IR-25-647)](https://fortiguard.fortinet.com/psirt/FG-IR-25-647)
- [CVE-2026-24858 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-24858)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1232