Threat reportRansomwareTL-2026-2989
FortiBleed: Ongoing Credential-Harvesting Campaign Against Fortinet FortiGate Firewalls and SSL VPN Gateways Feeds INC/Lynx and Payload Ransomware Access (FBI/USSS Alert)
FortiBleed: Ongoing Credential-Harvesting Campaign Against (TL-2026-2989), also tracked as FortiBleed, is a high-severity ransomware operation, first published 2026-10-06. It is attributed to SantaAd with medium confidence, affects Fortinet FortiGate / FortiOS (admin interface and SSL VPN), references 3 CVEs (CVE-2026-24858, CVE-2025-59718, CVE-2025-59719), maps to 15 MITRE ATT&CK techniques (T1021, T1040, T1078), and is covered by 9 detection rules and 15 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 15MITRE ATT&CK
- Actors
- 3SantaAd
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-2989
- Threat ID
- TL-2026-2989
- Also known as
- FortiBleed
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- SantaAd, Lynx, Payload ransomware affiliates
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- telecoms, government administration, health, finance, energy, it-services, manufacturing, higher education, critical-infrastructure
- Target regions
- Global, india, united states of america, Latin America, Asia Pacific, Europe
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in FortiBleed: Ongoing Credential-Harvesting Campaign Against
Malware and tooling: EKZ Stealer, FortigateSniffer, Lynx, inc ransom, payload, Hashtopolis, Masscan, PCAP Deep Analysis Toolkit v5.0, SNIFTRAN, Shodan
How FortiBleed: Ongoing Credential-Harvesting Campaign Against works
The FBI and Secret Service warn that the FortiBleed campaign against internet-facing Fortinet firewalls and VPN gateways remains active. Attackers can disable accounts, change passwords and lock out legitimate users, and the access has been used as an entry point by ransomware affiliates including INC/Lynx and Payload.
FortiBleed is a credential-exposure and initial-access campaign against internet-facing Fortinet FortiGate firewalls and FortiOS SSL VPN gateways. It was first publicly reported in mid-June 2026 (researcher Volodymyr 'Bob' Diachenko; sources give June 13-15) after an exposed server revealed a database of device URLs and working administrator and VPN credentials. Reported scale: 73,000-86,644 verified compromised devices across 194 countries (SOCRadar, CSA, Arctic Wolf), with later SOCRadar research putting the number of targeted FortiGate firewalls at roughly 430,000. India and the United States account for about one third of entries; telecommunications, government, healthcare, finance, energy and IT services are heavily represented.
Reported attack chain: (1) mass scanning for exposed management and VPN interfaces (Masscan, Shodan); (2) credential stuffing and brute force using passwords from prior breaches and infostealer logs; (3) export of device configuration files, whose legacy salted SHA-256 administrator password hashes were cracked offline on a roughly 45-GPU cluster managed with Hashtopolis (PBKDF2 hashing was introduced in FortiOS 7.2.11, 7.4.8 and 7.6.1, but legacy hashes persist until each admin logs in after upgrade); (4) login with valid credentials and deployment of a custom Go tool, FortigateSniffer, that abuses the native 'diagnose sniffer packet' command to passively capture authentication traffic (RADIUS, NTLM, Kerberos and others across 24 protocols) from about 12,000 devices; (5) reuse of harvested credentials against Active Directory, RADIUS servers and domain controllers, creation of persistent VPN tunnels and rogue admin or VPN accounts, and extraction of routing and network details. Fortinet has said there is no patch that closes this exposure and describes the activity as credential reuse and brute force against devices with weak passwords and no MFA, not a new vulnerability. Some third parties additionally link early footholds to FortiCloud SSO authentication bypasses CVE-2025-59718, CVE-2025-59719 and CVE-2026-24858 (CVSS 9.4, in CISA KEV); Fortinet states the campaign is not related to a recent advisory, so the CVE role is contested.
Attribution: SOCRadar (2026-07-02) assessed a financially motivated Russian-speaking initial access broker (roughly 20 people) and linked it to INC Ransom and Lynx after an operator with access to FortiBleed infrastructure was seen logged into both groups' negotiation panels; SOCRadar counted 409 admin-level accesses, 354 full compromises and at least 12 ransomware deployments. A CSA research note names the broker 'SantaAd' (single-source). The FBI/Secret Service alert of 2026-10-06 (as reported by CyberScoop) says the campaign remains active, that actors can disable accounts or change passwords to lock victims out, requiring remediation beyond patching and password resets, and that the access has served INC/Lynx and Payload ransomware affiliates and initial access brokers. The alert requests attacker IPs and usernames from victims but, per available reporting, publishes no IOCs.
MITRE ATT&CK techniques used in TL-2026-2989
Lateral Movement
T1021 Remote Services; T1550.002 Use Alternate Authentication Material: Pass the Hash; T1550.004 Use Alternate Authentication Material: Web Session Cookie
Credential Access
T1040 Network Sniffing; T1110.002 Brute Force: Password Cracking; T1110.004 Brute Force: Credential Stuffing
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Persistence
T1098 Account Manipulation; T1136.001 Create Account: Local Account
Impact
Reconnaissance
T1589.001 Gather Victim Identity Information: Credentials; T1595 Active Scanning
Collection
Affected products and versions in FortiBleed: Ongoing Credential-Harvesting Campaign Against
- Fortinet — FortiGate / FortiOS (admin interface and SSL VPN)
Vulnerable versions: Internet-exposed devices with weak or reused credentials, no MFA, or legacy SHA-256 admin password hashes (pre-PBKDF2 migration)
Fixed in: No patch closes the exposure; FortiOS 7.2.11, 7.4.8, 7.6.1 and later add PBKDF2 hashing once admins re-authenticate
Remediation for FortiBleed: Ongoing Credential-Harvesting Campaign Against
Patches
- Upgrade to FortiOS 7.4.x, 7.6.x or 8.0 builds with PBKDF2 hashing (7.2.11, 7.4.8, 7.6.1 or later) and have every admin log in after upgrade to migrate hashes
- Apply Fortinet fixes for CVE-2025-59718, CVE-2025-59719 and CVE-2026-24858 (FortiOS 7.4.11+ for CVE-2026-24858)
Immediate actions
- Remove FortiGate management interfaces from the public internet or restrict them to trusted hosts
- Terminate all active admin and SSL VPN sessions and rotate all admin and VPN credentials, especially default and built-in accounts
- Enforce MFA (phishing-resistant where possible) on admin and VPN accounts
- Review firewall and VPN configuration for unauthorized accounts (e.g. forticloud, fortiuser, fortinet-support, fortinet-tech-support), VPN tunnels, logging changes and config exports to external IPs
- Audit domain controller, RADIUS and VPN logs for lateral movement and logins from anomalous locations
Workarounds
- On 7.2.x/7.4.x set login-lockout-upon-weaker-encryption to remove legacy SHA-256 hashes
- Disable FortiCloud SSO on unpatched devices
Longer-term hardening
- Maintain an inventory of Fortinet devices, firmware versions and credential-hash status
- Migrate SSL VPN to certificate-based or FIDO2 authentication
- Forward FortiGate admin, config and VPN logs to a SIEM with alerts on new admin accounts and config exports
- Provide incident response plans for lockout scenarios that remediation beyond patching and password reset
CVEs associated with FortiBleed: Ongoing Credential-Harvesting Campaign Against
Weaknesses (CWE) in FortiBleed: Ongoing Credential-Harvesting Campaign Against
Timeline of FortiBleed: Ongoing Credential-Harvesting Campaign Against
- Fortinet discloses FortiCloud SSO authentication bypass CVE-2026-24858 (CVSS 9.4, added to CISA KEV); CSA and others cite it, with CVE-2025-59718/59719, as possible early footholds, though Fortinet says the campaign is not tied to a recent advisory
- Start of the campaign's active period per CSA research: reconnaissance and device compromise (phase 1, late February to April)
- Phase 2 (April to May): FortigateSniffer deployed on compromised FortiGate devices to capture authentication traffic
- Phase 3 (May 31 to June 15): 659 credential-harvesting pipelines launched, per CSA
- Researcher Volodymyr 'Bob' Diachenko reports an exposed server holding device URLs and valid Fortinet credentials (sources date the discovery June 13-15)
- CISA issues a hardening alert for FortiGate devices
- Fortinet PSIRT publishes its analysis; about 86,644 devices in 194 countries are reported as having harvested credentials; Fortinet says there is no patch that closes the exposure
- SOCRadar links the operators to INC Ransom and Lynx after an operator is seen in both groups' negotiation panels; 12 ransomware deployments confirmed
- FBI and Secret Service alert (IC3 CSA 2026/261006) says FortiBleed remains active, can lock out users, and has fed INC/Lynx and Payload ransomware affiliate intrusions
Sources cited for FortiBleed: Ongoing Credential-Harvesting Campaign Against
- Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks (CyberScoop)
- FBI/Secret Service FortiBleed alert (IC3 CSA 2026/261006)
- Fortinet PSIRT: Analysis of Reported Credential Compromise of FortiGate Devices
- SOCRadar: FortiBleed - The Campaign That Cracked 86,644 Firewalls
- Arctic Wolf: Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries
- Bitdefender: Technical Advisory - FortiBleed Credential Exposure Campaign
- SecurityWeek: Fortinet Responds to FortiBleed Campaign
- CSA Research Note: FortiBleed Default Credential Exploitation and Mass Fortinet Compromise
- CSA Research Note: FortiBleed - Anatomy of a 110-Million-Credential Harvesting Campaign
- Cybersecurity Dive: FortiBleed campaign traced to INC and Lynx ransomware operations
- RH-ISAC: FortiBleed Credential Theft Campaign Attributed to INC and Lynx Ransomware Groups
- Picus Security: FortiBleed - Inside the Campaign That Cracked 75,000 Fortinet Firewalls
- eSentire: FortiBleed Campaign - Credentials Exposed for 80,000 Fortinet Appliances
Detection coverage for TL-2026-2989
As of 2026-10-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2989 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.