Report: FortiBleed Campaign Targets 430,000 FortiGate Firewalls, Identifies 110 Million Credentials
Summary
Researchers describe FortiBleed, a campaign active since February 2026 that reportedly brute-forces exposed devices and uses FortigateSniffer to capture credentials. The operation is estimated to have identified over 110 million credentials.
Key points
- SOCRadar assesses that a Russian-speaking initial access broker is behind FortiBleed, active since February 2026 and targeting more than 430,000 FortiGate firewalls.
- The reported operation uses mass scanning, credential checks, brute-force attacks and credential stuffing; other targets include Synology NAS, Sophos firewalls, RDWeb, Citrix SSL-VPNs and MS-SQL servers.
- The Golang-based FortigateSniffer reportedly uses FortiOS diagnostic commands to passively capture cleartext credentials and hashes across 24 protocols.
- The report says hashes are cracked with Hashmat and Hashtopolis, coordinated through the HASHBOT Telegram bot, then reused for lateral movement and Active Directory enumeration.
- Researchers estimate that 659 credential-harvesting pipelines identified over 110 million credentials, including 89 million MySQL authentication tokens, 14.8 million RADIUS credentials, 924,000 NTLM hashes and 130,000 Kerberos hashes.
- The described operation also includes exfiltrating data from network shares and using stolen session cookies to maintain authenticated access.
Article Details
- Attack Vectors
- Mass scanning with Masscan and Shodan to identify exposed FortiGate firewalls, followed by filtering and grouping targets.
- Credential stuffing and dictionary attacks against FortiGate administrative panels and SSL-VPN portals, and automated brute-forcing of other internet-facing appliances.
- Obtaining administrative SSH access to compromised devices and deploying FortigateSniffer to capture cleartext credentials and password hashes from network traffic.
- Cracking captured hashes, then reusing credentials against Active Directory domains and other exposed services for lateral movement and enumeration.
- Exfiltrating sensitive data from network shares and using stolen session cookies to maintain authenticated access.
MITRE ATT&CK
T1021.004 · SSHThe attackers established administrative access to compromised devices via SSH before deploying FortigateSniffer.T1039 · Data from Network Shared DriveThe attackers exfiltrated sensitive data from network shares.T1040 · Network SniffingFortigateSniffer passively captured authentication traffic, including cleartext credentials and hashes, across 24 protocols.T1078 · Valid AccountsThe attackers reused cracked and harvested credentials against Active Directory domains and other exposed services.T1087.002 · Domain AccountThe article reports Active Directory enumeration after credential cracking and reuse.T1110.001 · Password GuessingThe campaign used dictionary attacks against FortiGate administrative panels and SSL-VPN portals.T1110.002 · Password CrackingCaptured password hashes were cracked using Hashmat and Hashtopolis.T1110.004 · Credential StuffingThe attackers used credential stuffing to obtain administrative SSH access and brute-force logins on internet-facing systems.T1550.004 · Web Session CookieStolen session cookies were used to maintain persistent, authenticated access.T1595.001 · Scanning IP BlocksThe operators used Masscan and Shodan for widespread reconnaissance of exposed FortiGate firewalls.
Threat Actors
Vendors
Citrixmore than 430,000 FortiGate firewalls and also affected Synology NAS, Sophos firewalls, RDWeb portals, Citrix SSL-VPNs, and MS-SQL servers.Fortinetto be part of a broader, multi-vendor initial access operation that’s orchestrated to not only target Fortinet devices, but also breach Synology NAS, Sophos firewalls, RDWeb portals, Citrix SSL-VPNs, and MS-SQLSophoscampaign that has targeted more than 430,000 FortiGate firewalls and also affected Synology NAS, Sophos firewalls, RDWeb portals, Citrix SSL-VPNs, and MS-SQL servers.Synologycredential-harvesting campaign that has targeted more than 430,000 FortiGate firewalls and also affected Synology NAS, Sophos firewalls, RDWeb portals, Citrix SSL-VPNs, and MS-SQL servers.
Products
Citrix SSL-VPNsthan 430,000 FortiGate firewalls and also affected Synology NAS, Sophos firewalls, RDWeb portals, Citrix SSL-VPNs, and MS-SQL servers.Fortinet FortiGateis behind FortiBleed, a large-scale credential-harvesting campaign that has targeted more than 430,000 FortiGate firewalls and also affected Synology NAS, Sophos firewalls, RDWeb portals, Citrix SSL-VPNs, and MS-SQLFortiOSCentral to the operation is a Golang-based tool called FortigateSniffer that takes advantage of the FortiOS built-in diagnostic command -diagnose sniffer packet to passively capture authentication traffic from theMicrosoft Active Directory“The actors then crack, validate, and reuse the credentials against Active Directory domains and other exposed services.”MS-SQLFortiGate firewalls and also affected Synology NAS, Sophos firewalls, RDWeb portals, Citrix SSL-VPNs, and MS-SQL servers.RDWebthat has targeted more than 430,000 FortiGate firewalls and also affected Synology NAS, Sophos firewalls, RDWeb portals, Citrix SSL-VPNs, and MS-SQL servers.Sophos firewallscampaign that has targeted more than 430,000 FortiGate firewalls and also affected Synology NAS, Sophos firewalls, RDWeb portals, Citrix SSL-VPNs, and MS-SQL servers.Synology NAScampaign that has targeted more than 430,000 FortiGate firewalls and also affected Synology NAS, Sophos firewalls, RDWeb portals, Citrix SSL-VPNs, and MS-SQL servers.
Tools
CyberStrikethreat actors may have sought the help of an open-source, AI-native offensive security platform dubbed CyberStrike to assist with some “parts of the workflow.” Interestingly, another open-source framework calledforticheckCompromise the devices with a credential checker named “forticheck” that specifically targets FortiGate’s administrative panel and SSL-VPN portal, along with using tools to obtain administrative SSH access viaFortigateSnifferThe operation uses mass scanning, brute-forcing, and the FortigateSniffer tool to steal credentials and hashes, then crack and reuse them for deeper access and lateral movement.FortiProbe-fastidentify vulnerable internet-facing FortiGate firewalls, followed by using a custom utility dubbed FortiProbe-fast and GeoSplit to filter FortiGate systems and group them by country, respectively.GeoSplitinternet-facing FortiGate firewalls, followed by using a custom utility dubbed FortiProbe-fast and GeoSplit to filter FortiGate systems and group them by country, respectively.HASHBOT#FortiBleedHashmatStolen hashes and credentials are cracked with Hashmat and Hashtopolis, then reused for access.HashtopolisStolen hashes and credentials are cracked with Hashmat and Hashtopolis, then reused for access.masscanThe attackers use Masscan, Shodan, and custom tools to find and filter exposed devices.ShodanThe attackers use Masscan, Shodan, and custom tools to find and filter exposed devices.