Threat reportData BreachTL-2026-4150
FortiBleed: Global Credential Attacks on Fortinet FortiGate SSL VPN Gateways and Leaked Credential Database (NCSC Alert)
FortiBleed: Global Credential Attacks on Fortinet FortiGate (TL-2026-4150), also tracked as FortiBleed, is a high-severity data breach, first published 2026-10-22. It has no confirmed attribution, affects Fortinet FortiGate firewalls and SSL VPN gateways (FortiOS), maps to 15 MITRE ATT&CK techniques (T1021.001, T1021.004, T1021.005), and is covered by 9 detection rules and 17 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-4150
- Threat ID
- TL-2026-4150
- Also known as
- FortiBleed
- Severity
- HIGH
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- telecoms, government administration, education, finance, health, manufacturing, critical-infrastructure, defense
- Target regions
- Global, india, North America, Latin America, Southeast Asia, East Asia, Middle East, Europe
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in FortiBleed: Global Credential Attacks on Fortinet FortiGate
Malware and tooling: Hashcat, Hashtopolis
How FortiBleed: Global Credential Attacks on Fortinet FortiGate works
The UK NCSC alerted on 18 June 2026 to a global campaign of brute-force, dictionary and credential-stuffing attacks against internet-facing FortiGate firewalls and SSL VPN portals, after which a database of harvested credentials (dubbed FortiBleed) was leaked. Public reporting cites roughly 74,000 exposed firewall URLs across 194 countries; Fortinet states no new vulnerability is involved.
On 18 June 2026 the UK National Cyber Security Centre (NCSC) published an alert on a global campaign targeting internet-facing Fortinet FortiGate firewalls and VPN gateways with SSL VPN enabled. Attackers ran brute-force, dictionary and credential-stuffing attempts against FortiGate and VPN portals, and a threat actor then leaked a database of the resulting credentials. The NCSC names no actor, CVE or specific IOC. Its only generic indicators are unauthorised account creation and unexpected activity in log files. CISA issued an advisory the same day, and Fortinet PSIRT published its analysis on 19 June 2026.
Public reporting names the leak FortiBleed. The exposure was noticed by researcher Volodymyr (Bob) Diachenko after the operators left a server exposed with their data and tooling. Kevin Beaumont independently confirmed the credentials were real. Hudson Rock reports 73,932 unique firewall URLs across 194 countries and about 21,600 unique domains. The Hacker News cites a later snapshot of 86,644 devices as of 19 June 2026. Reported victims span telecom, government, education, financial services, healthcare, manufacturing and critical infrastructure, and include a Turkish NATO defence contractor from which classified documents were reportedly taken. Top-affected countries per The Hacker News are India, the United States, Mexico, Colombia and Thailand. Of the compromised accounts, 35% were generic admin accounts, 28.3% built-in Fortinet system accounts and 36.7% organisation-specific accounts. The leaked data includes plaintext passwords, usernames and email addresses, and is believed to come from exported Fortinet configurations.
According to Diachenko, as relayed by BleepingComputer and Recorded Future, the operators are a Russian-speaking multi-operator group. They ran about 1.16 billion credential attempts against 320,777 FortiGate targets and 2.1 billion against 163,650 Microsoft SQL Server systems. They intercepted SSL VPN authentication hashes and cracked them offline on a 45-GPU cluster orchestrated with Hashtopolis and Hashcat. They used the recovered credentials to pivot into internal Active Directory environments, using AD/LDAP enumeration scripts, password spraying, and SMB/DFS collection scripts, and deleted logs to remove evidence. The Hacker News also describes passive network traffic monitoring through compromised appliances to harvest further credentials. Recorded Future reports that a seller using the handle SantaAd advertised the data for auction on the Exploit forum on 12 June 2026, and that a second actor, shinymontanna, operating under ShinyHunters branding, was seen on 21 June 2026 and is assessed to re-extort victims of other actors.
Fortinet states: this is not a new Fortinet vulnerability, and the activity is unrelated to any recent incident or advisory. Fortinet says attackers reused credentials from earlier incidents and brute-forced weak passwords on systems lacking MFA, and cites FG-IR-26-060 and FG-IR-25-647. The Hacker News lists CVE-2026-24858, CVE-2025-59718 and CVE-2025-59719 as referenced and notes that legacy SHA-256 credential hashing was replaced by PBKDF2 in FortiOS 7.2.11, 7.4.8 and 7.6.1. Legacy hashes persist after upgrade until the administrator re-authenticates. Because Fortinet disputes any vulnerability link, cve_list is left empty and no exploitation of those CVEs is asserted.
IOCs are limited. The only network indicator is 85.11.187.8 (AS211486), reported by Recorded Future in connection with credential harvesting and intrusions. A BeaconBeagle lookup for this IP returned HTTP 404, so no C2 correlation was found. Fortinet advises hunting for newly created accounts named forticloud, fortiuser, fortinet-support and fortinet-tech-support. Tooling filenames from the exposed operator server are also listed. Defenders should treat all FortiGate admin, SSL VPN and bound AD/LDAP credentials as compromised, enforce phishing-resistant MFA, remove internet-facing management interfaces, and review logs for rogue accounts and configuration changes.
MITRE ATT&CK techniques used in TL-2026-4150
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol; T1021.004 Remote Services: SSH; T1021.005 Remote Services: VNC
Collection
T1039 Data from Network Shared Drive; T1602.002 Network Device Configuration Dump
Credential Access
T1040 Network Sniffing; T1110 Brute Force; T1110.001 Brute Force: Password Guessing; T1110.002 Brute Force: Password Cracking; T1110.003 Brute Force: Password Spraying; T1110.004 Brute Force: Credential Stuffing
Initial Access
T1078 Valid Accounts; T1133 External Remote Services
Discovery
T1087.002 Account Discovery: Domain Account
Persistence
Affected products and versions in FortiBleed: Global Credential Attacks on Fortinet FortiGate
- Fortinet — FortiGate firewalls and SSL VPN gateways (FortiOS)
Vulnerable versions: Devices with internet-facing SSL VPN or admin portals and weak or reused passwords or no MFA; FortiOS releases before PBKDF2 hashing (before 7.2.11, 7.4.8 and 7.6.1 per CISA/Fortinet guidance)
Fixed in: No patch applies: credential attack, not a new vulnerability per Fortinet. Hardening: FortiOS 7.4, 7.6 or 8.0, MFA, credential reset
Remediation for FortiBleed: Global Credential Attacks on Fortinet FortiGate
Patches
- Upgrade to FortiOS 7.4, 7.6 or 8.0, which use PBKDF2 hashing (PBKDF2 introduced in 7.2.11, 7.4.8 and 7.6.1)
- Have administrators re-authenticate after upgrade so legacy SHA-256 hashes are replaced
Immediate actions
- Terminate all administrative and SSL VPN sessions and reset every FortiGate admin, SSL VPN and bound AD/LDAP credential
- Preserve logs, then isolate and factory-reset any device showing compromise indicators
- Hunt for new accounts named forticloud, fortiuser, fortinet-support and fortinet-tech-support and for unexpected configuration changes
- Check exposure with the SOCRadar or Hudson Rock FortiBleed lookup tools and treat AD/LDAP accounts bound to FortiGate as compromised
- Audit firewall, VPN, authentication and domain controller logs for lateral movement, SMB/DFS access and log deletion
Workarounds
- Restrict SSL VPN and admin access by source IP or geography where feasible
- Disable SSL VPN on devices that do not require it
Longer-term hardening
- Enforce phishing-resistant MFA on all VPN and management logins
- Remove internet-facing management interfaces or restrict them to trusted hosts
- Retire out-of-support FortiOS systems
- Monitor for credential exposure and rotate credentials after config exports
Weaknesses (CWE) in FortiBleed: Global Credential Attacks on Fortinet FortiGate
Timeline of FortiBleed: Global Credential Attacks on Fortinet FortiGate
- Recorded Future reports initial HTTP activity on port 9999 associated with the campaign infrastructure.
- Seller SantaAd, described as a credible member of the Exploit forum, posts an auction advertisement for the Fortinet credential data (Recorded Future).
- Recorded Future dates public disclosure by researcher Volodymyr Diachenko to 13 June; other outlets date the discovery to 18 June.
- SSH, VNC and RDP attack activity observed on 14-15 June (Recorded Future).
- NCSC publishes its global alert on Fortinet firewall and VPN targeting; CISA issues an advisory; BleepingComputer and Help Net Security report ~74,000 firewalls exposed; Kevin Beaumont and PwnDefend corroborate the credentials.
- Fortinet PSIRT publishes its analysis stating this is not a new vulnerability and listing rogue account names to hunt for; The Hacker News reports a snapshot of 86,644 devices.
- Recorded Future identifies the actor shinymontanna, operating under ShinyHunters branding and assessed to re-extort victims of other actors.
- Recorded Future publishes its FortiBleed analysis (republished 9 October 2026).
Sources cited for FortiBleed: Global Credential Attacks on Fortinet FortiGate
- NCSC Alert: advice following global targeting of Fortinet firewalls and VPN gateways
- NCSC Alert (PDF)
- Fortinet PSIRT: Analysis of reported credential compromise of FortiGate devices
- Fortinet Community: Collect indicators of compromise (IOC) debugs on a FortiGate
- BleepingComputer: FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices
- Help Net Security: 74,000 Fortinet firewall credentials exposed in FortiBleed data leak
- The Hacker News: CISA warns Fortinet customers as FortiBleed hits 86,644 FortiGate devices
- Recorded Future: FortiBleed campaign exposing credentials for 73,932 FortiGate systems
Detection coverage for TL-2026-4150
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4150 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4150
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.