FortiBleed Campaign Reportedly Compromises Fortinet Firewalls and VPN Gateways Worldwide
Summary
A reported global campaign targets internet-facing Fortinet devices using reused credentials and brute force. Researchers say tens of thousands of devices may be affected; links to recently patched vulnerabilities remain unconfirmed.
Key points
- The article describes an ongoing campaign targeting internet-facing Fortinet firewalls, SSL VPNs, and administrative portals across more than 190 countries.
- Fortinet's initial assessment attributes activity to reused credentials and brute-force attempts against devices with weak passwords and no MFA.
- The report says attackers intercept SSL VPN authentication data, crack it offline, and use compromised devices to monitor networks and obtain further credentials.
- Post-compromise activity reportedly includes persistence, lateral movement into Active Directory, and data exfiltration; some cases allegedly involved full network compromise.
- Possible exploitation of FortiSandbox and FortiClient EMS vulnerabilities is reported, but the article says no definitive link to the FortiBleed campaign has been established.
- Recommended measures include rotating credentials, enforcing MFA, patching Fortinet products, restricting management access, reviewing logs, and investigating suspected exposure.
Article Details
- Victim Organization
- Organizations using Fortinet infrastructure worldwide; no individual victim organization is identified
- Incident Type
- Large-scale intrusion campaign involving credential reuse, credential stuffing, brute-force authentication, interception of SSL VPN authentication data, persistence, lateral movement, and data exfiltration
- Data Types Exposed
- Credentials and SSL VPN authentication material
- Sensitive data
- Operational Impact
- The article reports compromise of tens of thousands of devices across more than 190 countries and says several organizations experienced full network compromise and data exfiltration. It does not identify specific victims or quantify affected records.
- Ransom Or Extortion
- No ransom or extortion activity is reported. The article says compromised-organization information was intended to be sold.
- Claim Status
- alleged
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 175[.]155[.]64[.]221 | Listed as a Hashtopolis instance associated with the campaign. |
| IPV4 | 185[.]229[.]26[.]83 | Listed as a Hashtopolis instance associated with the campaign. |
| IPV4 | 193[.]8[.]187[.]2 | Listed as a campaign jump box. |
| IPV4 | 198[.]53[.]64[.]194 | Listed as a Hashtopolis instance associated with the campaign. |
| IPV4 | 213[.]169[.]49[.]142 | Listed as a Hashtopolis instance associated with the campaign. |
| IPV4 | 38[.]117[.]87[.]37 | Listed as a Hashtopolis instance associated with the campaign. |
| IPV4 | 85[.]11[.]187[.]28 | Listed as the IP address used for Fortinet credential harvesting. |
| IPV4 | 85[.]11[.]187[.]8 | Listed as the IP address for the open directory/Hashtopolis associated with the campaign. |
MITRE ATT&CK
T1005 · Data from Local SystemThe article reports sensitive data extraction from compromised organizations.T1021 · Remote ServicesThe article describes lateral movement into internal systems after gaining access.T1078 · Valid AccountsThe article describes attackers reusing valid credentials to gain access.T1110 · Brute ForceThe article describes brute-force authentication attempts against exposed devices.T1110.003 · Password SprayingThe article describes credential stuffing using previously leaked credentials.T1557 · Adversary-in-the-MiddleThe article describes interception of SSL VPN authentication data during login sessions.
CVE
CVE-2026-21643FortiClient EMSVulnerabilities observed in active exploitation campaigns:CVE-2026-21643CVE-2026-25089CVE-2026-25089 (remote command execution)CVE-2026-39808FortiSandboxActively exploited via multiple critical CVEs:CVE-2026-39808 (command injection)CVE-2026-39813CVE-2026-39813 (authentication bypass)
Vendors
Products
FortiClient EMS- such as authentication bypass and remote command execution vulnerabilities in FortiSandbox and FortiClient EMS - are actively being weaponized in the wild, though again, there is no definitive link to FortiBleed.Fortinet FortiGateFortiGate (primary target)FortiSandboxRecently patched flaws - such as authentication bypass and remote command execution vulnerabilities in FortiSandbox and FortiClient EMS - are actively being weaponized in the wild, though again, there is no definitive
Tools
Industries
Critical infrastructurecompromise affecting tens of thousands of devices across more than 190 countries, including critical infrastructure and major multinational enterprises.Defensefull network compromise and data exfiltration, including entities in critical infrastructure and defense-related sectors.