Fortinet Responds to FortiBleed Campaign

1. Executive summary

Fortinet has confirmed a large-scale credential-harvesting campaign, tracked as FortiBleed, that has produced a database of over 86,000 confirmed working administrator and VPN credentials for FortiGate firewalls and Fortinet VPNs across 194 countries. Fortinet's position is that the activity does not exploit a new vulnerability; it reuses credentials harvested in prior incidents (notably the FortiCloud SSO authentication-bypass defects CVE-2026-24858, CVE-2025-59718, and CVE-2025-59719) and combines them with brute-force attacks against devices with weak password hygiene and no MFA. Independent reporting (Hudson Rock, Kevin Beaumont, Volodymyr Diachenko) indicates the actors also intercepted SSL VPN authentication, cracked hashes on a 45-GPU Hashtopolis cluster, and pivoted into internal Active Directory environments — with at least one Turkish NATO defence contractor confirmed fully compromised and classified defence documents stolen. For EMEA financial services firms, the bottom-line risk is direct: any FortiGate or FortiGate SSL VPN appliance exposed to the internet with weak or reused administrator credentials is a credible target for immediate takeover, lateral movement into AD, and onward fraud / data theft.

2. Regulatory framing

3. Technical analysis & attack chain

1. Initial access — credential reuse from prior FortiCloud SSO incidents. Threat actors reuse credentials harvested during exploitation of three FortiCloud SSO login authentication-bypass defects: CVE-2026-24858 (patched January), CVE-2025-59718 and CVE-2025-59719 (addressed in December). Fortinet states the campaign does not exploit a new vulnerability.
2. Initial access — brute force at scale. Where credentials are not already available, actors run large-scale brute-force / password-spraying attacks against FortiGate SSL VPN and admin interfaces. Reporting cites 1.16 billion credential attempts against 320,777 FortiGate targets and 2.1 billion attempts against 163,650 MSSQL servers. Devices with weak password hygiene and no MFA are the primary victims.
3. SSL VPN authentication interception and hash extraction. Actors intercept SSL VPN authentication and extract stored credential hashes from device configuration.
4. Offline hash cracking. Hashes are cracked offline on a 45-GPU Hashtopolis cluster, producing plaintext administrator credentials.
5. Database assembly. Cracked credentials are aggregated into a verified working-credentials database — Fortinet confirms >86,000 confirmed working credentials; Hudson Rock reports 21,632 unique domains affected; BleepingComputer cites 73,932 firewall URLs; The Register cites ~75,000 devices.
6. Lateral movement into internal AD. Once valid admin credentials are obtained, actors pivot into internal Active Directory environments (per Diachenko).
7. Impact / data access. At least four organisations are confirmed fully compromised, including a Turkish NATO defence contractor from which classified defence documents were stolen. Named affected organisations include FoxConn, Samsung, Comcast, Siemens, Lenovo, FedEx, Accenture, and Oracle.

Technical specifics that matter to a defender

• Targeted component: FortiGate firewall / Fortinet SSL VPN, including FortiCloud SSO login.
• Exploitation mechanism: credential reuse + brute force + offline hash cracking; not a new RCE.
• Hash cracking infrastructure: Hashtopolis-managed 45-GPU cluster.
• Scale of brute force: 1.16B attempts vs FortiGate; 2.1B vs MSSQL.
• Persistence vector: unchanged admin credentials and active admin/VPN sessions — terminating sessions and rotating credentials is the primary containment.
• Hardening requirement: upgrade to software releases that support PBKDF2 hashing of administrator credentials (Fortinet advisory).
• Exposure footprint: ~50% of all internet-exposed Fortinet devices per Shodan; most compromised devices remain online.

Unconfirmed / single-sourced claims. Attribution to a "Russian-speaking group" rests on a single LinkedIn post by Volodymyr "Bob" Diachenko. No MITRE actor profile is available in the verified reference data for this item; treat attribution as unconfirmed. The "Turkish NATO defence contractor" full compromise and exfiltration of classified defence documents is reported by The Register citing Diachenko; treat as unconfirmed pending primary-source corroboration.

4. Mitigation & containment

P1 — within 24 hours (containment)

• Terminate all active administrator and VPN sessions on every FortiGate / Fortinet VPN appliance in the estate. Do this before rotating credentials.
• Rotate every administrator and VPN user credential associated with Fortinet devices. Treat any credential that may have been reused elsewhere as compromised.
• Enforce MFA on all administrator accounts and on all SSL VPN user accounts. Block management access for any account that cannot be MFA-enrolled within the window.
• Restrict external management (HTTPS, SSH, SSL VPN) to trusted source IPs / management VLANs; close management ports to the public internet where operationally feasible.
• Block / rate-limit brute-force sources at the perimeter; Fortinet devices under sustained attack should be moved off public IPs entirely until hardened.

P2 — within 72 hours (remediation)

• Upgrade firmware to a Fortinet software release that supports PBKDF2 hashing of administrator credentials (per Fortinet advisory). Pin the version in the change record.
• Audit configurations for unauthorised changes: admin accounts, local users, firewall policies, VPN tunnels, routing, certificates, SNMP strings, DNS settings.
• Review logs for unexpected admin access: source IP, time-of-day, configuration diffs, new local users, new VPN users, unexpected policy objects.
• Reset any device that shows evidence of compromise to factory defaults, then rebuild from a known-good baseline configuration.
• Engage Fortinet via the support contract to confirm whether the device appears in Fortinet's notified-customer list; capture the response in the third-party file.

P3 — within 7 days (assurance)

• Concentration-risk review of Fortinet exposure across the estate (DORA Art. 29 trigger).
• Tabletop exercise of the incident management process against this scenario (DORA Art. 24 trigger where testing is in scope).
• Third-party file update with vendor advisories, patch evidence, MFA enforcement evidence, and management-plane segmentation evidence.
• Threat hunt across AD for indicators of the post-compromise tradecraft: new admin group additions, golden-ticket anomalies, unusual Kerberos pre-auth failures, and unexpected service-account use.

5. Indicators of compromise

No specific indicators of compromise (file hashes, C2 domains, C2 IPs, malware samples, distinctive strings) are present in the source material for this item. The campaign is characterised by credential reuse and brute force, not by a discrete malware payload.

(no IOCs available — see note above)

6. Detection

The following Sigma rules are authored from behavioural indicators described in the sources (brute-force volume, SSL VPN authentication interception, post-auth admin activity). They are intended as starting points and should be tuned to the entity's environment.

title: FortiGate SSL VPN Brute Force / Password Spray
id: ad9f0b1c-2c4d-4f8a-9b1e-3a4f5b6c7d8e
status: experimental
description: |
  Detects high-volume authentication failures against FortiGate SSL VPN,
  consistent with the brute-force / password-spray phase of the FortiBleed
  campaign (1.16B attempts vs 320,777 FortiGate targets reported).
author: Adverse Trace
date: 2026-06-22
references:

  - https://www.securityweek.com/fortinet-responds-to-fortibleed-campaign/
logsource:
  product: fortinet
  service: sslvpn
detection:
  selection:
    eventtype: auth-fail
  filter_known_noise:
    eventtype: auth-fail
    src_ip:

      - "10.0.0.0/8"
      - "172.16.0.0/12"
      - "192.168.0.0/16"
  condition: selection and not filter_known_noise
fields:

  - src_ip
  - user
  - dst_ip
falsepositives:

  - Forgotten credentials
  - Password rotation exercises
level: high

title: FortiGate Admin Login From New or Unexpected Source
id: 7c1a2b3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: |
  Detects successful FortiGate admin or SSL VPN login from a source IP not
  previously associated with the account, consistent with post-FortiBleed
  credential reuse.
author: Adverse Trace
date: 2026-06-22
references:

  - https://www.securityweek.com/fortinet-responds-to-fortibleed-campaign/
logsource:
  product: fortinet
  service: sslvpn
detection:
  selection_success:
    eventtype: auth-success
    user_group:

      - "admins"
      - "sslvpnpassword"
  condition: selection_success
fields:

  - src_ip
  - user
  - dst_ip
  - timestamp
falsepositives:

  - Travelling administrators
  - New managed-service partner onboarding
level: high

7. Sources

• SecurityWeek — Fortinet Responds to FortiBleed Campaign — https://www.securityweek.com/fortinet-responds-to-fortibleed-campaign/ — 2026-06-22
• SecurityWeek — FortiBleed: 86,000 Fortinet Device Credentials Compromised — https://www.securityweek.com/fortibleed-86000-fortinet-device-credentials-compromised/ — 2026-06-22
• DataBreaches.net — Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries — https://databreaches.net/2026/06/18/active-fortibleed-campaign-impacting-fortinet-devices-across-194-countries/ — 2026-06-18
• BleepingComputer — FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices — https://www.bleepingcomputer.com/news/security/fortibleed-leak-exposes-fortinet-vpn-credentials-for-73-000-devices/ — 2026-06
• The Register — Massive password-stealing attack hits 75k Fortinet firewalls — https://www.theregister.com/cyber-crime/2026/06/17/massive-password-stealing-attack-hits-75k-fortinet-firewalls/5257877 — 2026-06-17
• BleepingComputer — CISA warns Fortinet users to secure devices after FortiBleed leak — https://www.bleepingcomputer.com/news/security/cisa-warns-fortinet-users-to-secure-devices-after-fortibleed-leak/ — 2026-06
• Dark Reading — Sweeping Credential-Harvesting Heist Compromises +30K Fortinet Devices — https://www.darkreading.com/cyberattacks-data-breaches/sweeping-credential-harvesting-heist-compromises-30k-fortinet-devices — 2026-06

8. Adverse Trace position

Severity: HIGH. This is not a new-vulnerability exploit chain — it is a credential-reuse and brute-force campaign at unprecedented scale against a vendor (Fortinet) that is heavily concentrated in EMEA financial services. The combination of (a) ~50% of internet-exposed Fortinet devices reportedly affected, (b) most compromised devices remaining online, (c) confirmed full organisational compromise with data theft, and (d) the prior-vulnerability lineage (CVE-2026-24858, CVE-2025-59718, CVE-2025-59719) means any EMEA financial entity still running a FortiGate without MFA, with weak admin passwords, or on a firmware release without PBKDF2 hashing should be treated as presumed exposed. Attribution to a "Russian-speaking group" is unconfirmed and should not be relied upon for threat-actor-specific defences. Next steps: Adverse Trace will (i) push the P1 containment checklist to all clients with Fortinet exposure within 24 hours, (ii) initiate a vendor-level concentration-risk review under DORA Art. 29, and (iii) stand up a hunt across AD for the post-credential-reuse tradecraft described above.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.