FortiBleed Analysis Finds 148 Confirmed Compromises in Credential Campaign

Jun 19, 2026 · Original article ↗

Summary

Analysis of an exposed attacker directory traces a campaign targeting exposed Fortinet devices. Researchers say 21,632 entries did not represent verified breaches; their review found evidence of internal traffic at 918 organisations and 148 confirmed compromises.

Key points

FortiBleed is a credential-compromise campaign, not a Fortinet software vulnerability or zero-day.
An exposed attacker server contained 319 files, including scanning and cracking tools, credential datasets, post-exploitation scripts, and a live VPN configuration.
The operators used credential reuse, brute force, and offline hash cracking against internet-facing devices, then used tools to enumerate Active Directory and spray passwords.
Researchers found that the widely cited 21,632 figure counted attribution-database entries, not verified breaches; they identified internal Kerberos traffic at 918 organisations and cracked, verified AD credentials at 148.
The dataset included non-Fortinet devices and noisy attribution based on registration emails, limiting the reliability of claims about specific victims.
The report says the attacker infrastructure was deactivated at its source, but a Hashtopolis instance on the same IP remained active at the time of writing.
Recommended steps include removing management interfaces from public exposure, rotating administrator and VPN credentials, enabling MFA, and checking devices for signs of compromise.

Article Details

Attack Vectors: Credential reuse, brute force, and offline hash cracking against internet-exposed devices.
Scanning internet-facing web login interfaces and harvesting credentials across Fortinet and non-Fortinet devices.
Capturing Kerberos pre-authentication data with network sniffers after pivoting into victim networks.
Kerberos and SMB password spraying, LDAP-based Active Directory enumeration, SMB access testing, and network-share discovery.
Using validated credentials to access SSL VPNs and other remote-access targets.
Defensive Notes: Remove Fortinet firewall and SSL VPN management interfaces from direct public internet exposure and restrict administration to trusted internal networks.
Rotate administrator, VPN, LDAP, RADIUS, and service-account credentials that may have been exposed.
Enforce MFA on administrative and remote-access accounts.
Upgrade FortiOS to a release supporting PBKDF2 hashing and require administrator logins to trigger re-hashing.
Investigate unfamiliar successful administrator logins, audit for backdoor accounts and altered controls, and replace severely compromised devices.

Indicators of compromise

Type	Indicator	Context
IPV4	`175[.]155[.]64[.]221`	IP address identified as a Hashtopolis instance in the attacker infrastructure list.
IPV4	`185[.]229[.]26[.]83`	IP address identified as a Hashtopolis instance in the attacker infrastructure list.
IPV4	`193[.]8[.]187[.]2`	Attacker jumpbox used to relay into compromised networks.
IPV4	`198[.]53[.]64[.]194`	IP address identified as a Hashtopolis instance in the attacker infrastructure list.
IPV4	`213[.]169[.]49[.]142`	IP address identified as a Hashtopolis instance in the attacker infrastructure list.
IPV4	`38[.]117[.]87[.]37`	IP address identified as a Hashtopolis instance in the attacker infrastructure list.
IPV4	`85[.]11[.]187[.]28`	Infrastructure identified in the article as used for Fortinet credential harvesting.
IPV4	`85[.]11[.]187[.]8`	Exposed Hashtopolis coordination server identified as attacker infrastructure.