FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation

1. Executive summary

A financially motivated, Russian-speaking initial access broker (IAB) — operating under the handle SantaAd per Palo Alto Networks Unit 42 — has been conducting a large-scale credential-harvesting operation against Fortinet FortiGate firewalls since at least February 2026. The campaign, dubbed FortiBleed, has targeted over 430,000 FortiGate devices across 194 countries, harvested over 110 million credentials (including 14.8M RADIUS, 924K NTLM, 130K Kerberos, and 89M MySQL tokens), and produced a verified database of 30,000–75,000 working administrator credentials. The actor deploys a Golang-based sniffer (FortigateSniffer) that abuses the FortiOS built-in diagnostic command diagnose sniffer packet to passively capture authentication traffic across 24 protocols on compromised devices, then cracks hashes on a 45-GPU Hashtopolis cluster orchestrated by a Telegram bot (HASHBOT). The operation also extends to Synology NAS, Sophos firewalls, RDWeb, Citrix SSL-VPN, and MSSQL targets. EMEA financial services firms running FortiGate firewalls — particularly those using SSL-VPN, RADIUS, or Active Directory integration — face immediate risk of unauthorised remote access, lateral movement, and downstream supply-chain compromise via IT service providers.

2. Regulatory framing

Article	Trigger (fact in this item)	Practical impact
DORA Art. 17 — ICT-related incident management process	A confirmed, large-scale ICT-related incident affecting a third-party ICT component (FortiGate firewall) used by the financial entity.	Activate the documented ICT-related incident management process; assign roles, log evidence, and track containment/eradication steps.
DORA Art. 18 — classification of ICT-related incidents and cyber threats	The campaign has produced verified working admin credentials for tens of thousands of devices, including financial-sector targets, and is ongoing.	Classify the incident against internal severity criteria; treat as a major ICT-related incident and cyber threat until evidence proves otherwise.
DORA Art. 19 — reporting of major ICT-related incidents to competent authorities	If the incident is classified as major (credential compromise of a FortiGate used in production, or evidence of lateral movement into AD), reporting obligations are engaged.	Prepare initial, intermediate, and final notifications to the competent authority within the prescribed timelines; document classification rationale.
DORA Art. 28 — ICT third-party risk — general principles	Fortinet is an ICT third-party provider; the incident originates in a third-party product.	Apply the third-party risk framework; ensure contractual notification clauses are invoked with Fortinet.
DORA Art. 29 — preliminary assessment of ICT concentration risk	Widespread use of FortiGate across the sector creates a concentration risk; the campaign demonstrates the risk materialising.	Re-assess concentration risk; identify and document single points of failure in perimeter architecture.
DORA Art. 30 — key contractual provisions with ICT third-party providers	Vendor (Fortinet) cooperation is required to obtain IOCs, confirm patch status, and validate remediation.	Engage Fortinet support; confirm right-to-audit and information-sharing provisions are exercised.
NIS2 Art. 21(2)(d) — supply chain security measures	The campaign exploits Fortinet devices and adjacent vendors (Synology, Sophos, Citrix, MSSQL) — a multi-vendor supply-chain compromise.	Review supply-chain security measures covering these vendors; ensure proportionate controls apply to MSPs and IT service providers.
NIS2 Art. 23 — incident reporting obligations	An ongoing, large-scale cyber threat with confirmed impact across multiple Member States.	Comply with incident reporting timelines; coordinate with CSIRT where designated.
UK NIS 2018 — OES/RDSP duties	UK financial-sector entities that are OES/RDSPs and operate FortiGate firewalls are within scope of the incident.	Apply OES/RDSP incident handling and reporting duties under UK NIS 2018.

3. Technical analysis & attack chain

Confirmed attack chain (five stages, per SOCRadar / The Hacker News)

Wide-scale reconnaissance. Use of Masscan and Shodan to identify internet-facing FortiGate devices, followed by a custom utility FortiProbe-fast to filter FortiGate systems and GeoSplit to group targets by country.
Compromise. A credential checker named forticheck targets the FortiGate administrative panel and SSL-VPN portal; SSH administrative access is obtained via credential stuffing and dictionary attacks. Old and unpatched CVEs are abused to bypass authentication on vulnerable devices.
Sniffer deployment. A Golang-based tool, FortigateSniffer (Windows and Unix variants), is deployed via SSH. It invokes the FortiOS built-in diagnostic command diagnose sniffer packet to passively capture authentication traffic across 24 protocols: TACACS+, Kerberos, RPC, SMB, LDAP, SMTP, FTP, Telnet, RDP, WinRM, MS-SQL, MySQL, PostgreSQL, and RADIUS (among others). Cleartext credentials and password hashes are extracted.
Hash cracking and validation. Hashes are cracked using Hashmat and Hashtopolis (a 45-GPU cluster), orchestrated by a Telegram bot named HASHBOT. Cracked credentials are validated against Active Directory and other exposed services.
Lateral movement and exfiltration. Validated credentials are used for AD enumeration, Kerberos validation, and SMB authentication. Sensitive data is exfiltrated from network shares; stolen session cookies maintain persistent authenticated access.

Volume and reach

1.16 billion credential attempts against 320,777 FortiGate targets.
2.1 billion attempts against 163,650 MSSQL servers.
659 credential-harvesting pipelines launched between 31 May and 15 June 2026.
110 million credentials identified overall; 30,000–75,000 verified working FortiGate admin credentials.
21,632 unique domains affected; 194 countries.
At least four organisations fully compromised, including a Turkish NATO defence contractor from which classified defence documents were stolen.

Adjacent targets (multi-vendor scope)

The operation is not Fortinet-only. Initial and parallel targeting includes:

Synology NAS devices.
Sophos firewalls.
RDWeb portals.
Citrix SSL-VPN appliances.
MSSQL servers (brute-forced at scale).
Exposed RDP instances.

Tooling and infrastructure

Custom attack server infrastructure (described by Risky Bulletin as having impressed researchers).
Possible use of CyberStrike — an open-source, AI-native offensive security platform — for parts of the workflow. (Note: a separate framework, CyberStrikeAI, was used in an Amazon Threat Intelligence-documented automated mass-scanning campaign against FortiGate earlier in 2026; the link between the two is not confirmed.)
Hashtopolis hash-cracking cluster (45 GPUs).
Telegram bot HASHBOT for orchestration.
Per SOCRadar, portions of the infrastructure remain active at time of writing.

Observed impact

Verified working admin credentials for major multinationals including FoxConn, Samsung, Comcast, Siemens, Lenovo, FedEx, PxW, Accenture, and Oracle (per Hudson Rock / The Register).
Most compromised FortiGate devices remain online (per Kevin Beaumont).
Many compromised devices are on fairly recent patches — patching alone is insufficient.
Targeting skews toward SMBs with fewer than 200 employees, with notable emphasis on the United States and India, and the IT services sector as a downstream-access vector.

Caveats and unconfirmed attribution

Attribution to a "Russian-speaking initial access broker" is based on language analysis and tooling patterns; no MITRE ATT&CK profile exists for this actor. The handle SantaAd is attributed by Palo Alto Networks Unit 42 only. Treat attribution as unconfirmed.
The campaign's relationship to the earlier Amazon Threat Intelligence-documented FortiGate mass-scanning operation is not confirmed.
The exact CVEs exploited for authentication bypass are referenced in Fortinet's own report but are not enumerated in the source material provided; defenders should consult Fortinet's PSIRT advisories directly.

4. Mitigation & containment

P1 — within 24 hours (containment)

Rotate all credentials associated with FortiGate VPN, administrative interfaces, local admin accounts, and any accounts reused elsewhere. Assume any credential that has touched an affected device is compromised.
Force MFA on all FortiGate administrative and SSL-VPN access. Disable local admin accounts where central auth (RADIUS/LDAP/TACACS+) is available.
Isolate any FortiGate showing signs of unauthorised SSH sessions, unexpected diagnose sniffer packet invocations, or unknown processes. Block outbound C2 from FortiGate management interfaces at the network edge.
Audit SSH access logs on every FortiGate for sessions originating from non-trusted source IPs; revoke any active sessions.
Disable the SSL-VPN portal if business continuity permits, or restrict by source IP and require certificate-based auth + MFA.

P2 — within 72 hours (remediation)

Patch FortiOS to the latest vendor-recommended version. Confirm patch level against Fortinet PSIRT advisories; note that recent patches do not guarantee immunity — verify device integrity post-patch.
Re-image any FortiGate where compromise is suspected; do not rely on in-place remediation.
Rotate secrets stored in FortiGate configuration (RADIUS shared secrets, LDAP bind credentials, admin passwords, SNMP community strings, API keys).
Review AD and downstream service logs for use of harvested credentials; force a domain-wide password reset for any account that authenticated from a FortiGate IP.
Engage Fortinet support under DORA Art. 30 contractual provisions to obtain IOCs and confirm device integrity.

P3 — within 7 days (hardening)

Segment FortiGate management interfaces onto a dedicated, jump-host-only VLAN.
Disable diagnose sniffer packet and other diagnostic commands from non-admin shells where the FortiOS version permits.
Implement outbound DNS/IP filtering to block known C2 infrastructure.
Conduct a tabletop exercise under DORA Art. 24 covering FortiGate compromise scenarios.
Re-assess concentration risk (DORA Art. 29) and consider vendor diversification for new deployments.

5. Indicators of compromise

Type	Value	Confidence	Source
tool-name	`FortigateSniffer`	high	SOCRadar / The Hacker News
tool-name	`FortiProbe-fast`	high	SOCRadar
tool-name	`GeoSplit`	high	SOCRadar
tool-name	`forticheck`	high	SOCRadar
tool-name	`Hashmat`	high	SOCRadar
tool-name	`Hashtopolis`	high	SOCRadar
tool-name	`HASHBOT` (Telegram bot)	high	SOCRadar
tool-name	`CyberStrike` (suspected)	low	The Hacker News
command	`diagnose sniffer packet` (FortiOS diagnostic)	high	SOCRadar / Risky Bulletin
actor-handle	`SantaAd`	medium	PAN Unit 42 (via Risky Bulletin)

tool       FortigateSniffer
tool       FortiProbe-fast
tool       GeoSplit
tool       forticheck
tool       Hashmat
tool       Hashtopolis
tool       HASHBOT
tool       CyberStrike
command    diagnose sniffer packet
actor      SantaAd

6. Detection

YARA rule

rule AT_FortiBleed_FortigateSniffer_2026 {
    meta:
        author = "Adverse Trace"
        date = "2026-06-24"
        description = "Detects artefacts associated with the FortiBleed FortiGate credential-harvesting campaign"
        reference = "https://thehackernews.com/2026/06/fortibleed-targeted-fortigate-firewalls.html"
    strings:
        $tool1 = "FortigateSniffer" ascii wide
        $tool2 = "FortiProbe-fast" ascii wide
        $tool3 = "GeoSplit" ascii wide
        $tool4 = "forticheck" ascii wide
        $tool5 = "Hashmat" ascii wide
        $tool6 = "Hashtopolis" ascii wide
        $tool7 = "HASHBOT" ascii wide
        $cmd   = "diagnose sniffer packet" ascii
    condition:
        any of ($tool*) or $cmd
}

Sigma rule

title: FortiBleed — FortigateSniffer Diagnostic Sniffer Abuse
id: AT-2026-06-24-158
status: experimental
description: >
    Detects invocation of the FortiOS 'diagnose sniffer packet' diagnostic
    command outside of expected administrative workflows, consistent with the
    FortiBleed credential-harvesting campaign.
author: Adverse Trace
date: 2026-06-24
reference: https://thehackernews.com/2026/06/fortibleed-targeted-fortigate-firewalls.html
logsource:
    product: fortinet
    service: fortigate
detection:
    selection_cmd:
        cmdline|contains: "diagnose sniffer packet"
    selection_tool:
        process|contains:

            - "FortigateSniffer"
            - "FortiProbe-fast"
            - "GeoSplit"
            - "forticheck"
    condition: selection_cmd or selection_tool
falsepositives:

    - Legitimate use by Fortinet TAC during support engagements
    - Internal red-team exercises
level: high

7. Sources

The Hacker News — FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation — https://thehackernews.com/2026/06/fortibleed-targeted-fortigate-firewalls.html — 2026-06-23
DataBreaches.net — Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries — https://databreaches.net/2026/06/18/active-fortibleed-campaign-impacting-fortinet-devices-across-194-countries/ — 2026-06-18
The Register — Massive password-stealing attack hits 75k Fortinet firewalls — https://www.theregister.com/cyber-crime/2026/06/17/massive-password-stealing-attack-hits-75k-fortinet-firewalls/5257877 — 2026-06-17
SecurityWeek — Russian Initial Access Broker Behind FortiBleed Campaign — https://www.securityweek.com/russian-initial-access-broker-behind-fortibleed-campaign/ — 2026-06
SecurityWeek — Fortinet Responds to FortiBleed Campaign — https://www.securityweek.com/fortinet-responds-to-fortibleed-campaign/ — 2026-06
Dark Reading — FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist — https://www.darkreading.com/cyberattacks-data-breaches/fortibleed-attackers-firewalls-credentials-stealers — 2026-06
Risky Business News — Risky Bulletin: The FortiBleed incident is so much worse than a simple credentials leak — https://news.risky.biz/risky-bulletin-the-fortibleed-incident-is-so-much-worse-than-a-simple-credentials-leak/ — 2026-06

8. Adverse Trace position

Severity: High. FortiBleed is not a single-vendor credential leak — it is an active, multi-vendor initial-access operation with a verified working-credential database spanning tens of thousands of FortiGate devices, including EMEA financial-sector targets. The actor's use of the native diagnose sniffer packet command makes detection difficult without baseline behavioural monitoring, and the campaign's reliance on credential stuffing means patching alone is insufficient. Client impact: any EMEA financial entity operating FortiGate firewalls — particularly those using SSL-VPN, RADIUS, or AD integration, or relying on IT service providers as downstream access paths — should treat this as a confirmed exposure and execute the P1 containment steps immediately. Attribution to a Russian-speaking IAB (handle SantaAd) is unconfirmed; we will update if a MITRE ATT&CK profile emerges. Next steps: Adverse Trace will (1) monitor for Fortinet PSIRT IOCs and update this advisory, (2) correlate harvested credential lists against client telemetry where lawful, and (3) assist clients with DORA Art. 18/19 classification and reporting workflows.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.