FortiBleed 2.0 Analysis Finds 40,573 Cleartext Secrets in FortiGate Configuration Records
Summary
Hudson Rock's FortiBleed 2.0 analysis of 1,703 configuration reports found 40,573 cleartext secret records and 975 domain labels absent from its FortiBleed 1.0 comparison. The records do not establish successful internal compromise or current access.
Key points
- The analysis covers 1,703 source files associated with 1,689 nonempty host identifiers. Most report timestamps are February 20, 2026; these are report dates, not established compromise or extraction dates.
- The 101,419 account and credential records include 40,573 cleartext secret records, among them 37,076 local-user entries and 1,576 LDAP bind entries.
- Of 1,453 distinct domain labels in the comparison, 975 were absent from the FortiBleed 1.0 set. The analysis cautions that these labels do not represent a count of newly compromised organizations.
- The described toolchain covers configuration parsing and secret recovery, VPN connection attempts using eligible credentials, and reported NetExec activity against internal systems. Successful internal access is not established.
- The article cites FortiCloud SSO abuse as wider campaign context and discusses CVE-2026-24858, but says the records do not establish one initial-access method for every host. A direct relationship with Qilin or The Gentlemen remains unconfirmed.
- Recommended checks include updating firmware, restricting management access, terminating sessions, rotating relevant exposed credentials, reviewing administrator and LDAP accounts, and investigating possible lateral movement.
- The records do not establish continuous attacker access, successful internal compromise, current credential usability, or the outcome of subsequent remediation.
Article Details
- Attack Vectors
- The reported toolchain parses FortiGate configuration reports and recovers stored secrets, including cleartext values and some reversibly encrypted values that may be recoverable offline under certain FortiOS key settings. The article does not establish one initial-access mechanism for every host.
- A reported vpn_checker.py / openconnect workflow uses eligible VPN credentials to attempt connections; whether access is possible depends on account status, VPN policy, MFA requirements, and reachability.
- The article describes nxc / NetExec activity against internal systems as part of the associated toolchain, but does not establish successful access to those systems.
- FortiCloud SSO abuse is described as broader campaign context for CVE-2026-24858; the article does not tie this mechanism to every exposed host.
- Defensive Notes
- Apply appropriate firmware updates, restrict management access, terminate sessions, reset relevant credentials, review configurations, and investigate potential lateral movement.
- Compare administrator accounts with approved ownership, configuration history, and logs; investigate recurring account names and remove accounts confirmed to be unauthorized.
- Review LDAP bind identities and privileges, rotate exposed secrets that remain relevant, update dependent services, and inspect authentication activity.
- Review VPN policies and external authentication dependencies, verify effective MFA, and assess exposed local-user, HA, RADIUS, and SMTP secrets alongside the services that use them.
MITRE ATT&CK
T1110 · Brute ForceThe article says Fortinet's June assessment discusses brute-force activity in the broader FortiCloud SSO campaign context; it does not establish this activity for every exposed host.T1552.001 · Credentials In FilesThe reported parsing workflow extracts cleartext secrets from FortiGate configuration reports, including local-user and LDAP bind credentials.
CVE
Threat Actors
k0tHudson Rock credits NyxLab with foundational technical research into the threat actor known as k0t and associated extraction tooling; the article does not directly attribute every exposed configuration to k0t.QilinRelated Group-IB and NyxLab research is described as reporting victim overlap with Qilin; a direct affiliation or supplier relationship with the FortiBleed activity remains unconfirmed.The GentlemenRelated Group-IB and NyxLab research is described as reporting victim overlap with The Gentlemen; a direct affiliation or supplier relationship with the FortiBleed activity remains unconfirmed.
Vendors
Fortinetwider campaign context. CVE-2026-24858 (CVSS 9.4) affects FortiOS, FortiProxy, and FortiSwitchManager. Fortinet records issuing its advisory on January 27, 2026, before the February report timestamps. Its JuneHudson RockFortiBleed 2.0: 975 New Domains & 40,573 Exposed Secrets – Claim Your Ethical Disclosure | Hudson Rock
Products
Fortinet FortiGateNewly obtained FortiGate configuration reports reveal 40,573 records containing cleartext secrets, including 37,076 local-user records and 1,576 Active Directory LDAP bind records.FortiOSFortiCloud SSO abuse is part of the wider campaign context. CVE-2026-24858 (CVSS 9.4) affects FortiOS, FortiProxy, and FortiSwitchManager. Fortinet records issuing its advisory on January 27, 2026, before the FebruaryFortiProxyFortiCloud SSO abuse is part of the wider campaign context. CVE-2026-24858 (CVSS 9.4) affects FortiOS, FortiProxy, and FortiSwitchManager. Fortinet records issuing its advisory on January 27, 2026, before the FebruaryFortiSwitchManageris part of the wider campaign context. CVE-2026-24858 (CVSS 9.4) affects FortiOS, FortiProxy, and FortiSwitchManager. Fortinet records issuing its advisory on January 27, 2026, before the February report timestamps.
Tools
forti_parse.pyThe parsing workflow described around forti_parse.py collects administrator entries, local users, LDAP connections, HA settings, and email-server credentials.NetExecResearch into the associated toolchain describes nxc / NetExec activity against internal systems.openconnectThe reported vpn_checker.py / openconnect workflow uses eligible VPN credentials to attempt connections.vpn_checker.pyThe reported vpn_checker.py / openconnect workflow uses eligible VPN credentials to attempt connections.