SOCRadar Reports FortiBleed Campaign Used Custom FortiGate Credential Sniffer
Summary
SOCRadar says a campaign active since at least February 2026 targeted over 430,000 FortiGate firewalls, using a custom sniffer to capture authentication data. Fortinet said the earlier credential collection involved previously compromised credentials, not a new flaw or
Key points
- SOCRadar says the campaign targeted more than 430,000 FortiGate firewalls and has been active since at least February 2026.
- The researchers say attackers gained administrative access through credential stuffing and brute force, then used FortigateSniffer to capture authentication traffic via FortiOS diagnostics.
- SOCRadar says SNIFTRAN and a PCAP analysis toolkit extracted credentials and password hashes from captured traffic.
- The article reports that attackers allegedly used Hashcat on GPU clusters to crack hashes; Kevin Beaumont separately suggested they also obtained hashes from FortiGate configuration files.
- Fortinet previously told BleepingComputer the credential collection involved previously compromised credentials, rather than a new vulnerability or incident.
- Organizations are advised to review Beaumont’s published list of targeted IP addresses and investigate their FortiGate devices.
Article Details
- Event Type
- Reported credential-theft campaign targeting FortiGate devices, using a custom sniffer on compromised firewalls to capture authentication traffic.
- Impact
- SOCRadar says the campaign has targeted more than 430,000 FortiGate firewalls worldwide and has been active since at least February 2026. It reportedly stole credentials, password hashes, and other authentication material that could be used to gain access to corporate networks. Fortinet had described the incident to BleepingComputer as a collection of previously compromised credentials rather than a new vulnerability or incident.
MITRE ATT&CK
T1021.004 · SSHThe reported sniffer connected to FortiGate devices over SSH to launch the packet-capture command.T1040 · Network SniffingThe reported FortigateSniffer tool captured authentication traffic passing through compromised FortiGate devices.T1110.001 · Password GuessingSOCRadar says the attackers used brute-force attacks to gain administrative access to FortiGate devices.T1110.002 · Password CrackingThe attackers allegedly used Hashcat to crack stolen password hashes offline.T1110.004 · Credential StuffingSOCRadar says the attackers used credential stuffing to gain administrative access to FortiGate devices.
People
Vendors
Products
Fortinet FortiGateSOCRadar says the FortiBleed campaign targeted more than 430,000 FortiGate firewalls and used a custom tool called FortigateSniffer to capture authentication traffic and steal credentials from compromised devices.FortiOSThe attackers allegedly abused FortiOS diagnostics, processed captured traffic with SNIFTRAN and a PCAP analysis toolkit, and used Hashcat on GPU clusters to crack hashes and extract secrets.
Tools
FortigateSnifferSOCRadar says the FortiBleed campaign targeted more than 430,000 FortiGate firewalls and used a custom tool called FortigateSniffer to capture authentication traffic and steal credentials from compromised devices.hashcatThe attackers allegedly abused FortiOS diagnostics, processed captured traffic with SNIFTRAN and a PCAP analysis toolkit, and used Hashcat on GPU clusters to crack hashes and extract secrets.PCAP Deep Analysis ToolkitThe captured data was then parsed through a Python-based “PCAP Deep Analysis Toolkit” that extracted cleartext credentials, password hashes, Kerberos tickets, NTLM authentication material, email credentials, databaseSNIFTRANThe attackers allegedly abused FortiOS diagnostics, processed captured traffic with SNIFTRAN and a PCAP analysis toolkit, and used Hashcat on GPU clusters to crack hashes and extract secrets.