Global 'FortiBleed' Campaign Exposes Credentials from Over 86,000 Fortinet Devices
‘FortiBleed’ Campaign Harvests Credentials from 86,000+ Fortinet Devices
Impact Scope
People Affected
Credentials for 86,644 organizations exposed
Industries Affected
Related Entities(initial)
Organizations
Products & Tech
Full Report(when first published)
Executive Summary
A massive, ongoing credential-harvesting campaign named 'FortiBleed' has compromised over 86,644 Fortinet devices globally, including FortiGate firewalls and SSL VPN gateways. Researchers at SOCRadar uncovered the operation, which involves threat actors systematically scanning the internet for Fortinet devices and using brute-force and password-spraying techniques with previously breached credentials to gain access. The attackers have amassed a database of working logins for organizations across 194 countries, spanning all sectors. Fortinet has clarified that this is not the result of a new zero-day vulnerability but rather a large-scale attack on poor security practices, such as weak, reused passwords and the absence of multi-factor authentication (MFA). Global cybersecurity agencies are urging all Fortinet customers to assume exposure, rotate all credentials, and enable MFA immediately.
Threat Overview
The 'FortiBleed' campaign is a stark reminder that even without a zero-day, poor security hygiene on critical network infrastructure can lead to a widespread compromise. The threat actors, believed to be Russian-speaking, have been running this automated operation since at least February 2026.
The attack methodology is a simple but effective cycle:
- Scan: The attackers continuously scan the internet for exposed FortiGate management interfaces and SSL VPN portals.
- Brute-Force: They use large lists of common passwords and credentials stolen from previous data breaches to launch password spraying and brute-force attacks (
T1110 - Brute Force) against the discovered devices. - Compromise: Once a valid username/password combination is found, they gain access to the device.
- Harvest: The compromised device is then used as a listening post to harvest more credentials from VPN traffic passing through it.
- Recycle: The newly harvested credentials are fed back into the scanning and brute-force operation, expanding the campaign's reach.
This automated feedback loop allows the campaign to grow exponentially. Victims include a wide range of organizations, from banks and hospitals to government agencies, with the telecommunications sector being a particularly heavy target.
Technical Analysis
The campaign's success hinges entirely on exploiting weak security configurations. The primary TTPs are:
T1110.001 - Brute Force: Password Guessing: Trying common and default passwords against user accounts.T1110.003 - Brute Force: Password Spraying: Using a small list of common passwords against a large list of usernames to avoid account lockouts.T1078 - Valid Accounts: Using credentials stolen from other data breaches, assuming users have reused passwords across different services.
The core issue is the exposure of management interfaces to the public internet combined with weak authentication. Once an attacker gains administrative access to a firewall or VPN gateway, they have complete control over the network perimeter, allowing them to monitor traffic, disable security policies, and pivot deeper into the internal network.
Impact Assessment
The impact of a compromised edge device like a FortiGate firewall is severe. An attacker with administrative access can:
- Monitor All Network Traffic: Capture sensitive data, including credentials, intellectual property, and personal information passing through the network.
- Man-in-the-Middle Attacks: Intercept and modify network traffic.
- Bypass Security Controls: Disable firewall rules and security policies to allow further malicious activity.
- Network Pivoting: Use the compromised device as a launchpad to attack internal network resources.
- Persistent Access: Create backdoors or new administrative accounts to maintain long-term access.
The exposure of 86,000+ credentials means that a vast number of organizations are currently at high risk of a full network compromise.
IOCs — Directly from Articles
No specific IOCs like IP addresses or domains were provided in the source articles.
Cyber Observables — Hunting Hints
The following patterns can help identify compromised Fortinet devices:
Detection & Response
- Log Auditing: Immediately audit all FortiGate administrative and VPN login logs for successful logins from unrecognized IP addresses or locations.
- Configuration Review: Scrutinize the device configuration for any unauthorized changes, including new local user accounts, firewall policies, or VPN settings.
- Terminate Sessions: Force a termination of all active administrative and VPN sessions to evict any active threat actors.
Mitigation
- Rotate All Credentials: Immediately change all passwords for local users on Fortinet devices, including administrative and VPN user accounts. (MITRE Mitigation:
M1027 - Password Policies) - Enforce MFA: Enable phishing-resistant multi-factor authentication for all administrative and SSL VPN user access. This is the most critical defense against this campaign. (MITRE Mitigation:
M1032 - Multi-factor Authentication) - Restrict Management Access: Do not expose the FortiGate management interface to the public internet. Access should be restricted to a trusted internal network or via a secure jump host. (MITRE Mitigation:
M1035 - Limit Access to Resource Over Network) - Implement Strong Password Policies: Enforce complexity requirements and a sufficient minimum length for all passwords.
Timeline of Events
Article Updates
June 25, 2026
FortiBleed campaign now impacts 430,000 Fortinet devices, harvesting 110 million credentials using a custom Go-based sniffer, with access sold for ransomware attacks.
Update Sources:
MITRE ATT&CK Mitigations
Multi-factor Authentication
The single most effective mitigation. Enforcing MFA on all administrative and VPN accounts would render the stolen credentials useless.
Password Policies
Enforcing strong, unique passwords makes brute-force and password reuse attacks significantly harder to execute successfully.
Restricting access to device management interfaces from the public internet dramatically reduces the attack surface available for brute-force attacks.
Account Use Policies
Implementing account lockout policies after a certain number of failed login attempts can thwart brute-force attacks.
D3FEND Defensive Countermeasures
The FortiBleed campaign is a textbook case for the necessity of MFA. Since the attack relies entirely on single-factor authentication (username/password), enforcing MFA on all Fortinet administrative and SSL-VPN accounts is the definitive countermeasure. Organizations should prioritize phishing-resistant methods like FIDO2 where possible, but any form of MFA (such as TOTP authenticator apps) would have stopped this attack. This is not a recommendation; it is an urgent requirement for any organization using Fortinet devices. The failure to implement MFA on internet-facing critical infrastructure is a severe security gap that threat actors are actively and successfully exploiting at scale.
A core failure enabling the FortiBleed campaign is the exposure of device management interfaces to the entire internet. Organizations must apply strict inbound traffic filtering. The administrative interfaces for FortiGate devices should never be accessible from the public internet. Access should be restricted to a specific, allowlisted set of trusted IP addresses, such as those from a corporate office or a secure management network. This simple firewall rule dramatically reduces the attack surface, making it impossible for the attackers' automated scanners to even find the login page, let alone brute-force it. This is a foundational security best practice for managing any network infrastructure.
To detect brute-force and password spraying attacks in real-time, organizations should implement authentication event thresholding. This involves configuring systems to generate a high-priority alert when a certain threshold of failed login attempts is exceeded for a single user account or from a single source IP address within a short time window. For password spraying, the logic should be reversed: alert when a single IP attempts to log in to many different user accounts. Many platforms, including Fortinet, have features for account lockouts after a number of failed attempts. These should be enabled to automatically thwart brute-force attacks. These alerts should be ingested into a SIEM for correlation and immediate investigation by the security team.
Timeline of Events
The 'FortiBleed' credential harvesting campaign begins.
The campaign's existence and scale are publicly reported, with warnings issued by cybersecurity agencies.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.