FortiBleed Campaign Exposes Credentials for Nearly 74,000 FortiGate Systems
Summary
Researchers report that the FortiBleed campaign exposed valid credentials for about 73,932 FortiGate systems across 194 countries. Analysis indicates attackers cracked captured VPN hashes and used recovered credentials for follow-on network access.
Key points
- The dataset allegedly contains administrative and SSL VPN credentials for about 73,932 FortiGate firewall URLs across 194 countries; researchers independently verified samples.
- Reportedly affected organizations include government, critical infrastructure, telecom, finance, healthcare, and multinational companies.
- The investigation describes billions of credential attempts, captured SSL VPN authentication hashes, and GPU-assisted hash cracking.
- Recovered credentials were reportedly used to access internal Active Directory environments; researchers found evidence of enumeration, password spraying, data collection, and log clearing.
- A Turkish NATO defense contractor was reportedly affected, with classified documents allegedly exfiltrated.
- Recorded Future assesses one seller claiming FortiBleed data is likely credible, while another appears to be using the claim to re-extort victims; the data's connection to the credible seller's offer is unconfirmed.
- Organizations are advised to rotate FortiGate and VPN credentials, enable MFA, review logs, restrict exposed management interfaces, patch and harden devices, and investigate possible downstream compromise.
Article Details
- Victim Organization
- Not disclosed; affected organizations include government, critical infrastructure, and multinational corporations.
- Incident Type
- Credential harvesting and exposure, followed by credential cracking and reported access to internal Active Directory environments.
- Incident Date
- 2026-06-07
- Disclosure Date
- 2026-06-13
- Data Types Exposed
- FortiGate administrative credentials
- SSL VPN credentials
- Classified documents (allegedly exfiltrated from a Turkish NATO defense contractor)
- Affected Records
- Approximately 73,932 FortiGate firewall URLs were covered by the dataset; the number of affected records is not stated.
- Operational Impact
- Researchers reported confirmed or reported compromises among organizations in Japan, Taiwan, Vietnam, Iraq, and Türkiye. Some sampled administrative credentials were confirmed authentic, and many affected devices reportedly remained online with internet-exposed management interfaces. Threat actors allegedly accessed internal Active Directory environments and exfiltrated classified documents from a Turkish NATO defense contractor.
- Ransom Or Extortion
- Insikt Group assessed that SantaAd was likely a credible seller advertising FortiGate VPN data, but could not confirm whether it was the incident data. Insikt Group assessed that shinymontanna was likely attempting to re-extort victims; its claim of responsibility was not confirmation of involvement in the incident.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 85[.]11[.]187[.]8 | IP address identified by Insikt Group and independently reported as associated with FortiBleed-related credential harvesting, cracking, and follow-on network activity. |
MITRE ATT&CK
People
Threat Actors
SantaAdInsikt Group assessed SantaAd was likely a credible seller; SantaAd advertised an auction of FortiGate VPN data, but the article says it is unconfirmed whether that data was from the FortiBleed incident.shinymontannaSeller using ShinyHunters branding who claimed responsibility for FortiBleed; Insikt Group assessed it was likely attempting to re-extort victims, and its involvement in the incident is unconfirmed.
Vendors
Products
FortiGateA dataset containing valid administrative and VPN credentials for tens of thousands of Fortinet FortiGate firewalls has been attributed to a Russian-speaking threat group, with confirmed impacts across government,FortiOSMany affected devices reportedly remained online at the time of disclosure, ran recent FortiOS versions, and had management interfaces exposed to the internet.Microsoft SQL ServerConducted approximately 2.1 billion credential attempts against 163,650 Microsoft SQL Server (MSSQL) systems
Tools
Countries
IraqConfirmed or reported compromises include organizations in Japan, Taiwan, Vietnam, Iraq, and Türkiye.JapanConfirmed or reported compromises include organizations in Japan, Taiwan, Vietnam, Iraq, and Türkiye.TaiwanConfirmed or reported compromises include organizations in Japan, Taiwan, Vietnam, Iraq, and Türkiye.TürkiyeVietnamConfirmed or reported compromises include organizations in Japan, Taiwan, Vietnam, Iraq, and Türkiye.
Industries
Critical infrastructurebeen attributed to a Russian-speaking threat group, with confirmed impacts across government, critical infrastructure, and multinational corporations.DefenseAmong those affected is a Turkish NATO defense contractor from which threat actors allegedly exfiltrated classified documents.Financial ServicesAffected organizations span government, telecommunications, financial services, healthcare, manufacturing, and critical infrastructure sectors, including multinational corporations.Governmentfirewalls has been attributed to a Russian-speaking threat group, with confirmed impacts across government, critical infrastructure, and multinational corporations.HealthcareAffected organizations span government, telecommunications, financial services, healthcare, manufacturing, and critical infrastructure sectors, including multinational corporations.ManufacturingAffected organizations span government, telecommunications, financial services, healthcare, manufacturing, and critical infrastructure sectors, including multinational corporations.TelecommunicationsAffected organizations span government, telecommunications, financial services, healthcare, manufacturing, and critical infrastructure sectors, including multinational corporations.