Dark_Alpha Advertises FortiGate Access Linked to FortiBleed Campaign
Summary
DarkOwl reports that Dark_Alpha advertised FortiGate access tied to the FortiBleed credential-compromise campaign, including a listing of 6,355 U.S. device accesses. The actor also posted listings targeting organizations in several countries.
Key points
- Dark_Alpha advertised FortiGate access to 35,000 corporate targets across 194 countries for $25,000, claiming it was linked to FortiBleed.
- Three days after CISA’s June 18 advisory, the actor listed 6,355 FortiGate accesses from U.S.-based entities for $7,000 in bulk.
- DarkOwl found other listings attributed to Dark_Alpha involving alleged government entities in Bolivia and Brazil, and targets in Vietnam and India; some access claims could not be independently verified.
- A separate listing on the Russian-language Exploit forum shared an identical TOX ID, suggesting—but not confirming—a connection to Dark_Alpha.
- DarkOwl says the actor’s access listings align with the scale and geographic scope of the FortiBleed campaign, but the actor’s relationship to other named actors remains uncertain.
- The article says organizations should verify FortiGate patch status, rotate credentials, enforce MFA, and remove management interfaces from the public internet, consistent with CISA guidance.
Article Details
- Event Type
- Dark_Alpha advertised and sold alleged FortiGate/Fortinet access associated with the FortiBleed credential-compromise campaign on Darkforums, alongside other organizational access listings.
- Impact
- The article reports verified working administrator credentials for 73,932 to 86,000 FortiGate devices across 21,632 organizations in 194 countries. Dark_Alpha advertised access to 35,000 corporate targets and separately listed 6,355 valid FortiGate accesses from U.S.-based entities. Additional listings allegedly offered access to organizations in Bolivia, Brazil, Vietnam, and India, including two government entities and a medical-device-sector entity. Claims about access and its acquisition methods are not independently verified by DarkOwl.
Threat Actors
Dark_AlphaDarkforums member who advertised FortiGate/Fortinet access and posted other organizational access listings; DarkOwl attributes the activity to this actor but notes that cross-forum attribution is uncertain.SantaAdHandle attributed in separate research to a threat actor linked to the original FortiBleed data exposure; any relationship to Dark_Alpha is unresolved.
Vendors
Products
DarkForumsAbout DarkforumsFortiGateIn mid-June 2026, security researchers identified a large-scale credential compromise campaign targeting Fortinet FortiGate firewalls, quickly dubbed FortiBleed.FortiOSand cracked the stored password hashes — exploiting the fact that many organizations running older FortiOS versions continued to store administrator credentials as legacy SHA-256 hashes rather than the more
Tools
Countries
BoliviaFortiBleed listing, Dark_Alpha has been actively posting access listings targeting organizations across Bolivia, Vietnam, India, the United States, and Brazil — including at least two alleged government entities.Brazilposting access listings targeting organizations across Bolivia, Vietnam, India, the United States, and Brazil — including at least two alleged government entities.IndiaThe United States, India, and Mexico were among the most heavily affected countries.MexicoThe United States, India, and Mexico were among the most heavily affected countries.United StatesThe United States, India, and Mexico were among the most heavily affected countries.Vietnamlisting, Dark_Alpha has been actively posting access listings targeting organizations across Bolivia, Vietnam, India, the United States, and Brazil — including at least two alleged government entities.
Industries
Government ITalleged government entities, and thousands of compromised devices across critical sectors including government IT and medical devices.Medical Devices & EquipmentLater that same day, the actor posted a second listing: FortiGate VPN/portal access to an Indian entity in the Medical Devices & Equipment sector, with claimed revenue of $3 billion and 1,193 hosts.