Report Details FortiBleed’s GPU-Powered Password-Cracking Campaign Against Fortinet Firewalls
Summary
The article describes Hudson Rock’s FortiBleed reporting: credentials exposed from nearly 75,000 FortiGate firewalls across 21,632 domains, and attackers reportedly using rented GPU clusters and Hashtopolis to crack hashes and pursue access to internal networks.
Key points
- Hudson Rock’s disclosure reportedly identified valid credentials for nearly 75,000 internet-facing FortiGate firewalls across 21,632 domains.
- The article says attackers rented 36 enterprise-class GPUs through Vast[.]ai and managed the distributed cracking operation with Telegram and Hashtopolis.
- The article estimates the cluster could process up to 720 billion raw salted SHA-256 hashes per second and 180 million to 360 million PBKDF2 hashes per second.
- Attackers reportedly harvested FortiOS configuration files, cracked administrator passwords, and targeted about 143,000 Kerberos and 33,000 NetNTLM hashes.
- The article says attackers used Cursor to help write management code and agentic penetration-testing frameworks for Active Directory enumeration.
- Recommended triage includes auditing unexpected configuration exports, checking for exposed or reused credentials, rotating administrator passwords, and reviewing MFA.
Article Details
- Attack Vectors
- Attackers harvested encrypted FortiOS configuration files from exposed Fortinet devices and cracked the stored password hashes using rented GPU clusters.
- The article reports that infostealer logs and previously harvested credentials supplied initial access to Fortinet devices.
- Operators used network sniffers to capture Kerberos and NetNTLM hashes from internal networks.
- The article describes attackers using valid credentials to access networks and pivot toward vendors, managed service providers, and internal systems.
- Defensive Notes
- Review system event logs for unexpected Fortinet configuration backups or exports.
- Cross-reference active administrative accounts against known infostealer exposures.
- Treat exposed configurations as a credential compromise and require firewall administrators to rotate passwords.
- Audit MFA configurations for bypasses and dormant accounts.
MITRE ATT&CK
T1040 · Network SniffingThe article says the operators deployed network sniffers to capture Kerberos and NetNTLM hashes from internal networks.T1078 · Valid AccountsThe article describes attackers using valid, authorized credentials to access networks and move beyond the initial perimeter.T1087.002 · Domain AccountAfter pivoting into internal networks, the operators used agentic penetration-testing frameworks for Active Directory enumeration.T1110.002 · Password CrackingThe attackers used a rented 36-GPU cluster and Hashtopolis to crack hashes from stolen FortiOS configuration files.
People
Threat Actors
Vendors
FortinetFortiBleed exposed 75,000 compromised Fortinet firewalls and showed how attackers rented Vast.ai GPU clusters to crack passwords at industrial scale using Hashtopolis and Telegram-managed infrastructure.Vast.aiFortiBleed exposed 75,000 compromised Fortinet firewalls and showed how attackers rented Vast.ai GPU clusters to crack passwords at industrial scale using Hashtopolis and Telegram-managed infrastructure.
Products
Tools
Cursor#FortiBleedHashtopolisFortiBleed exposed 75,000 compromised Fortinet firewalls and showed how attackers rented Vast.ai GPU clusters to crack passwords at industrial scale using Hashtopolis and Telegram-managed infrastructure.TelegramFortiBleed exposed 75,000 compromised Fortinet firewalls and showed how attackers rented Vast.ai GPU clusters to crack passwords at industrial scale using Hashtopolis and Telegram-managed infrastructure.