FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems

1. Executive summary

A dataset dubbed "FortiBleed" containing valid administrative and SSL VPN credentials for approximately 73,932 Fortinet FortiGate firewall URLs across 194 countries and more than 21,600 domains has been exposed and partially validated by independent researchers. The dataset is attributed to a "Russian-speaking threat group" (attribution unconfirmed — no MITRE ATT&CK profile exists for this actor). Attackers conducted ~1.16 billion credential attempts against 320,777 FortiGate targets and ~2.1 billion attempts against 163,650 MSSQL servers, intercepted SSL VPN authentication hashes, and cracked them offline using a 45-GPU Hashtopolis cluster. Many affected devices remain online with management interfaces exposed to the internet. EMEA financial services firms running Fortinet FortiGate are at high risk of credential-based remote access and lateral movement into internal Active Directory environments; immediate credential rotation and exposure verification are required.

2. Regulatory framing

3. Technical analysis & attack chain

Attack chain (confirmed steps)

1. Reconnaissance and credential brute-force: Attackers conducted approximately 1.16 billion credential attempts against 320,777 FortiGate targets and approximately 2.1 billion attempts against 163,650 MSSQL servers.
2. SSL VPN authentication interception: Attackers intercepted SSL VPN authentication hashes from targeted FortiGate devices.
3. Configuration file export: Researchers assess the dataset likely originated from exported FortiGate configuration files, enabling offline credential recovery without ongoing device access.
4. Offline hash cracking: Attackers used a 45-GPU cluster managed via Hashtopolis to crack hashes and recover plaintext credentials.
5. Lateral movement: Recovered credentials were used to access internal Active Directory environments in confirmed compromises.
6. Data exfiltration: At a Turkish NATO defense contractor, attackers allegedly exfiltrated classified documents following full network compromise.

Technical specifics

• Affected products: Fortinet FortiGate firewalls and VPN gateways (all FortiOS versions; many affected devices reportedly run recent patches).
• Credential types exposed: Administrative and SSL VPN credentials.
• Scale: ~73,932 FortiGate firewall URLs; ~21,632–21,632 unique domains; 194 countries; approximately half of all internet-facing Fortinet firewalls per Shodan.
• Confirmed victims (named): FoxConn, Samsung, Comcast, Siemens, Lenovo, FedEx, Accenture, Oracle, and a Turkish NATO defense contractor.
• Sectors impacted: Government, telecommunications, financial services, healthcare, manufacturing, critical infrastructure.
• Attack infrastructure: IP address 85.11.187.8, associated with AS211486 within the 85.11.187.0/24 range.
• HTTP activity on port 9999 observed June 7, 2026.
• SSH, VNC, RDP, and additional attack-capture-related activity observed June 14–15, 2026.
• Corroborated independently by PwnDefend blog post on June 18, 2026.
• CISA response: CISA issued a public advisory urging Fortinet customers to take immediate protective steps.

Unconfirmed or single-sourced claims

The attribution to a "Russian-speaking threat group" is unconfirmed — no MITRE ATT&CK profile exists for this actor. The specific scale figures (1.16B attempts, 2.1B attempts, 45-GPU cluster, Hashtopolis usage) originate from researcher Volodymyr "Bob" Diachenko's investigation and have not been independently corroborated in the provided sources. The Turkish NATO defense contractor compromise and classified document exfiltration is reported but not independently verified in the provided material.

4. Mitigation & containment

P1 — Within 24 hours

• Rotate all FortiGate administrative and SSL VPN credentials across all Fortinet deployments, regardless of whether the device appears in the dataset.
• Enable multi-factor authentication on all FortiGate administrative and SSL VPN access.
• Audit FortiGate management interfaces for internet exposure; restrict access to trusted IPs/VPNs immediately.
• Search for IP 85.11.187.8 in firewall, VPN, and authentication logs (June 7, 2026 onward); block at perimeter.
• Review Active Directory authentication logs for anomalous logons originating from FortiGate management subnets or from the 85.11.187.0/24 range.

P2 — Within 72 hours

• Export and inspect FortiGate configuration files for unauthorized modifications; compare against known-good baselines.
• Review SSL VPN logs for authentication anomalies, unusual source IPs, or session patterns consistent with credential reuse.
• Engage Fortinet support under contractual incident notification clauses (DORA Art. 30).
• Conduct preliminary concentration risk assessment (DORA Art. 29) to determine scope of Fortinet exposure across the enterprise.

P3 — Within 7 days

• Apply latest FortiOS firmware to all FortiGate devices; verify patch level against Fortinet PSIRT advisories.
• Implement network segmentation between FortiGate management interfaces and internal AD/domain controllers.
• Conduct tabletop exercise to validate incident response process (DORA Art. 17) and classification criteria (DORA Art. 18).
• Review and update third-party risk register (DORA Art. 28) to reflect Fortinet exposure.

5. Indicators of compromise

ipv4  85.11.187.8
network  85.11.187.0/24
port  9999

6. Detection

Sigma rule — network activity from FortiBleed infrastructure

title: Network Activity from FortiBleed IP 85.11.187.8
id: at-2026-06-19-130-001
status: experimental
description: |
  Detects HTTP, SSH, VNC, or RDP connections originating from IP 85.11.187.8,
  associated with the FortiBleed credential harvesting campaign.
author: Adverse Trace
date: 2026-06-19
references:

  - https://www.recordedfuture.com/blog/critical-fortibleed-campaign
logsource:
  product: firewall
  category: firewall
detection:
  selection:
    src_ip: 85.11.187.8
  filter_legitimate:
    dst_port:

      - 22
      - 3389
      - 5900
      - 9999
  condition: selection and filter_legitimate
level: high
tags:

  - attack.initial_access
  - attack.credential_access
  - attack.lateral_movement

Insufficient indicators to author a YARA rule — no malware samples, filenames, or distinctive strings were provided in the source material.

7. Sources

• Recorded Future. "FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems." June 19, 2026. https://www.recordedfuture.com/blog/critical-fortibleed-campaign
• The Register. "Massive password-stealing attack hits 75k Fortinet firewalls." June 17, 2026. https://www.theregister.com/cyber-crime/2026/06/17/massive-password-stealing-attack-hits-75k-fortinet-firewalls/5257877
• Help Net Security. "74,000 Fortinet firewall credentials exposed in FortiBleed data leak." June 18, 2026. https://www.helpnetsecurity.com/2026/06/18/fortinet-fortibleed-data-leak/
• DataBreaches.net. "Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries." June 18, 2026. https://databreaches.net/2026/06/18/active-fortibleed-campaign-impacting-fortinet-devices-across-194-countries/
• BleepingComputer. "FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices." June 2026. https://www.bleepingcomputer.com/news/security/fortibleed-leak-exposes-fortinet-vpn-credentials-for-73-000-devices/
• SecurityWeek. "FortiBleed: 86,000 Fortinet Device Credentials Compromised." June 2026. https://www.securityweek.com/fortibleed-86000-fortinet-device-credentials-compromised/
• The Hacker News. "CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices." June 2026. https://thehackernews.com/2026/06/cisa-warns-fortinet-customers-as.html

8. Adverse Trace position

This is a high-severity incident for EMEA financial services. The exposure of valid administrative and SSL VPN credentials for ~74,000 FortiGate devices — many still online and internet-exposed — creates an immediate and ongoing remote access risk. The offline cracking methodology means affected organizations may have no logs of the initial credential theft, complicating forensic reconstruction. Attribution to a "Russian-speaking threat group" remains unconfirmed; we treat this as unattributed until a MITRE ATT&CK profile or independent corroboration emerges. Next steps: Adverse Trace will (1) monitor for additional IOCs and Fortinet PSIRT guidance, (2) track CISA and ENISA advisories for updated mitigation guidance, and (3) assist clients with credential rotation, exposure verification, and DORA/NIS2 reporting obligations as required.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.