Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries

1. Executive summary

A large-scale, currently active credential-compromise campaign — dubbed "FortiBleed" — is targeting internet-exposed Fortinet FortiGate firewalls and VPN gateways. Threat actors are extracting device configuration files, cracking the stored credential hashes offline, and validating working administrator credentials against roughly 30,000–75,000 FortiGate devices across 194 countries (21,632 unique corporate domains). Verified victims named in the leaked dataset include FoxConn, Samsung, Comcast, Siemens, Lenovo, FedEx, Accenture and Oracle; at least four organisations are confirmed fully compromised, including a Turkish NATO defence contractor from which classified defence documents were stolen. For EMEA financial services firms running Fortinet perimeter devices, the bottom-line risk is full administrative takeover of the firewall and pivot into internal Active Directory — meaning the perimeter device, not just credentials, must be treated as compromised until proven otherwise.

2. Regulatory framing

3. Technical analysis & attack chain

1. Reconnaissance / target selection. Attackers enumerated internet-exposed Fortinet FortiGate SSL VPN endpoints. The Register/Hudson Rock reporting cites roughly 320,777 FortiGate targets subjected to credential attempts and 163,650 MSSQL targets subjected to brute-force activity.
2. Initial access — SSL VPN authentication interception. Attackers "intercept SSL VPN authentication" against FortiGate devices (per Diachenko). The mechanism is consistent with credential capture at the SSL VPN portal and/or extraction of the device configuration file containing hashed credentials.
3. Configuration / hash extraction. Threat actors systematically extract FortiGate configuration files from internet-facing devices. The configuration contains hashed local-user and administrator credentials.
4. Offline hash cracking. Cracking is performed on a 45-GPU cluster orchestrated via Hashtopolis (open-source hash-cracking orchestration). This is an offline operation against the stolen hashes.
5. Credential validation & working-credential database. Cracked credentials are validated and assembled into a verified working-credential database covering ~30,000–75,000 devices / 21,632 domains.
6. Re-entry & lateral movement. Validated credentials are used to log in to FortiGate admin/SSL VPN interfaces. Attackers then pivot into internal Active Directory environments.
7. Impact. At least four organisations are confirmed fully compromised, including a Turkish NATO defence contractor from which classified defence documents were exfiltrated.

Technical specifics that matter to a defender

• Affected component: Fortinet FortiGate firewalls and FortiGate VPN gateways, internet-facing SSL VPN.
• Attack surface: SSL VPN authentication endpoint and the FortiGate administrative interface.
• Tooling observed: Hashtopolis (hash-cracking orchestration) running on a 45-GPU cluster.
• Pivot target: Internal Active Directory environments.
• Scale of brute-force activity: ~1.16 billion credential attempts against 320,777 FortiGate targets; ~2.1 billion attempts against 163,650 MSSQL servers.
• Patching status: Per Beaumont, "many of the devices sampled are on fairly recent patches" — patching alone is not a sufficient control; the leak suggests credential exposure independent of patch level.
• Persistence of compromised devices: Most compromised FortiGate devices remain online (per Shodan observation cited by Beaumont), increasing re-entry risk.

Caveats / unconfirmed elements

• Attribution to a "Russian-speaking group" is sourced to a single researcher (Diachenko) on LinkedIn. No MITRE-attributed actor profile is available in the verified reference data; treat attribution as unconfirmed.
• The exact extraction mechanism (vulnerability exploited vs. misconfiguration / default credential / known credential capture) is not specified in the source material. Treat the underlying vulnerability as unknown until Fortinet or a CVE assignment clarifies it.
• The "FortiBleed" name is community-applied; no vendor advisory or CVE has been cited in the source material.

4. Mitigation & containment

P1 — within 24 hours (containment)

1. Identify exposed Fortinet estate. Inventory all FortiGate / FortiGate VPN devices with internet-facing SSL VPN or admin interfaces. Use Shodan / Censys / vendor tools to confirm exposure.
2. Rotate ALL credentials associated with Fortinet VPN and administrative interfaces (local accounts, RADIUS/LDAP bind accounts, any service accounts referenced in config). Do this regardless of whether the device appears in the leaked dataset.
3. Force-enable MFA on Fortinet admin and SSL VPN access. Block fallback to password-only where the platform supports it.
4. Restrict source IPs / network ranges to the FortiGate admin and SSL VPN interfaces. Place the admin interface behind a bastion / jump host and remove direct internet exposure where operationally feasible.
5. Block / rate-limit the FortiGate SSL VPN and MSSQL (1433/2433) endpoints at perimeter and WAF/IDS layers; alert on anomalous auth volumes.
6. Hunt for re-entry. Review FortiGate logs (admin logins, SSL VPN auth, config changes, unknown tunnels, new local users, policy changes) for the last 90 days minimum. Look for logins from unfamiliar IPs/ASNs and post-exploitation config changes.
7. Isolate any FortiGate device with confirmed unauthorised admin activity; do not rely on in-place patching alone.

P2 — within 72 hours (remediation & hardening)

1. Apply latest FortiOS / firmware available from Fortinet for the device model. Confirm signature/hash on the upgrade image before installation.
2. Re-issue certificates used by FortiGate for SSL VPN and admin GUI; rotate any PSKs/IPsec keys.
3. Audit Active Directory for indicators of pivot from FortiGate compromise: new service principals, new privileged group members, unusual Kerberos pre-auth failures, golden/silver ticket artefacts, suspicious MSSQL-authenticated sessions.
4. Review MSSQL exposure (default 1433) — close internet exposure, enforce Windows auth, audit for the brute-force activity described.
5. Engage Fortinet support / TAC to obtain any vendor-issued guidance or integrity checks for the affected FortiOS versions.

P3 — within 7 days (governance & resilience)

1. Third-party / concentration risk review under DORA Art. 28–30: document Fortinet footprint, single points of failure, contractual notification/audit rights.
2. Tabletop / incident management rehearsal under DORA Art. 17 for the Fortinet-specific scenario.
3. Detection engineering to deploy the Sigma rule in §6 across SIEM.
4. Threat intel subscription to track FortiBleed-specific IOCs as they emerge; subscribe to Fortinet PSIRT advisories.

5. Indicators of compromise

No specific indicators of compromise (file hashes, C2 IPs/domains, mutexes, registry keys) are present in the source material. The only named tooling artefact is Hashtopolis (hash-cracking orchestration) and the attack surface is the FortiGate SSL VPN / admin interface.

tool     Hashtopolis

6. Detection

Sigma rule — high-volume auth attempts against Fortinet SSL VPN and MSSQL

title: High-Volume Authentication Attempts Against Fortinet SSL VPN and MSSQL
id: AT-2026-06-18-123-001
status: experimental
description: |
  Detects high-volume authentication attempts consistent with the FortiBleed
  campaign: brute-force / credential-stuffing activity against Fortinet
  FortiGate SSL VPN endpoints and MSSQL servers.
author: Adverse Trace
date: 2026-06-18
references:

  - https://www.theregister.com/cyber-crime/2026/06/17/massive-password-stealing-attack-hits-75k-fortinet-firewalls/5257877
logsource:
  product: firewall
  category: firewall
detection:
  selection_fortinet_sslvpn:
    vendor: "Fortinet"
    product: "FortiGate"
    action: "ssl-vpn-login"
  selection_mssql:
    service: "mssql"
    event: "authentication"
  threshold:
    attempts: 1000
    timeframe: 1h
  condition: (selection_fortinet_sslvpn or selection_mssql) and threshold
fields:

  - src_ip
  - user
  - dest_ip
falsepositives:

  - Legitimate password rotation campaigns
  - Penetration testing
level: high
tags:

  - attack.credential_access
  - attack.t1110

YARA rule — Hashtopolis artefacts on a compromised host

rule AT_FortiBleed_Hashtopolis_Artefacts
{
    meta:
        author      = "Adverse Trace"
        date        = "2026-06-18"
        description = "Detects Hashtopolis hash-cracking orchestration artefacts associated with the FortiBleed campaign"
        reference   = "https://www.theregister.com/cyber-crime/2026/06/17/massive-password-stealing-attack-hits-75k-fortinet-firewalls/5257877"

    strings:
        $a1 = "Hashtopolis" ascii wide
        $a2 = "hashtopolis" ascii wide
        $a3 = "hashcat" ascii wide
        $a4 = "45-GPU" ascii wide

    condition:
        2 of them
}

7. Sources

• DataBreaches.net — Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries (Arctic Wolf summary), 2026-06-18. https://databreaches.net/2026/06/18/active-fortibleed-campaign-impacting-fortinet-devices-across-194-countries/
• The Register — Massive password-stealing attack hits 75k Fortinet firewalls, 2026-06-17. https://www.theregister.com/cyber-crime/2026/06/17/massive-password-stealing-attack-hits-75k-fortinet-firewalls/5257877
• BleepingComputer — FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices, 2026-06-18. https://www.bleepingcomputer.com/news/security/fortibleed-leak-exposes-fortinet-vpn-credentials-for-73000-devices/
• Help Net Security — 74,000 Fortinet firewall credentials exposed in FortiBleed data leak, 2026-06-18. https://www.helpnetsecurity.com/2026/06/18/fortinet-fortibleed-data-leak/
• Dark Reading — Sweeping Credential-Harvesting Heist Compromises +30K Fortinet Devices, 2026-06-18. https://www.darkreading.com/cyberattacks-data-breaches/sweeping-credential-harvesting-heist-compromises-30k-fortinet-devices

8. Adverse Trace position

This is a high-impact, currently active credential-compromise campaign rather than a single CVE-driven exploit; severity is driven by confirmed working administrator credentials, full organisational compromise at named victims, and the observation that even recently-patched devices are affected. For EMEA financial services clients, the immediate risk is re-entry into any internet-exposed Fortinet device whose credentials may appear in the leaked dataset, with subsequent pivot into Active Directory — treat the perimeter device as compromised until credential rotation, MFA enforcement, and log review are complete. Attribution to a "Russian-speaking group" remains unconfirmed (single-source, no MITRE profile in the verified reference data). Next steps: Adverse Trace will (a) refresh detection content as concrete IOCs emerge, (b) support clients with Fortinet footprint inventory and credential rotation, and (c) re-issue this advisory if Fortinet or a CVE assignment clarifies the underlying extraction mechanism.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.