> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Russian Initial Access Broker Behind FortiBleed Campaign - URL: https://f4n6.co.uk/security-feed/russian-initial-access-broker-behind-fortibleed-campaign/ - Published: 2026-06-23T22:13:35.000Z - Updated: 2026-06-23T22:13:35.000Z - Author: Jeff Davies - Tags: #security-feed, Russian Initial Access Broker ## 1\. Executive summary A financially motivated, Russian-speaking initial access broker (IAB) has been conducting a large-scale credential-harvesting campaign — dubbed **FortiBleed** — against internet-exposed Fortinet FortiGate firewalls since at least February 2026\. The actor uses a custom Golang sniffer ("FortigateSniffer") that abuses a legitimate FortiOS diagnostic command to passively capture authentication traffic across 24 protocols, then cracks harvested hashes offline on a 45-GPU Hashtopolis cluster. SOCRadar estimates more than **110 million credentials** have been captured, with a verified working-credential database covering **73,932–86,000 FortiGate devices** across **194 countries** and **21,600+ domains**. Affected sectors include financial services, government, telecommunications, healthcare, manufacturing and critical infrastructure; named victims include Foxconn, Samsung, Comcast, Siemens, Lenovo, FedEx, Accenture and Oracle, plus a Turkish NATO defence contractor from which classified documents were exfiltrated. **Bottom-line risk for EMEA financial services:** any organisation running FortiGate with an internet-exposed management or SSL-VPN interface should treat its admin and VPN credentials as compromised until proven otherwise, rotate immediately, and audit for follow-on Active Directory and MSSQL activity. ## 2\. Regulatory framing | Article | Trigger (fact in this item) | Practical impact | | -------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 (ICT-related incident management process) | Confirmed credential compromise of FortiGate devices with potential AD lateral movement | Activate the documented ICT incident management process; assign incident manager, evidence chain, post-incident review | | DORA Art. 18 (classification of ICT-related incidents and cyber threats) | Credential theft affecting 73,932+ devices across 194 countries, including financial services firms | Classify against the ICT-incident taxonomy; document classification rationale | | DORA Art. 19 (reporting of major ICT-related incidents to competent authorities) | Major ICT-related incident affecting a financial entity's perimeter and identity layer | File initial notification, intermediate and final reports within the prescribed reporting windows to the competent authority | | DORA Art. 28 (ICT third-party risk — general principles) | Fortinet is an ICT third-party provider; the vulnerability lies in its product | Re-evaluate Fortinet third-party risk; record the incident in the third-party register | | DORA Art. 29 (preliminary assessment of ICT concentration risk) | Widespread use of FortiGate across the EU financial sector creates concentration risk | Assess whether FortiGate represents a substitutable dependency; document concentration findings | | DORA Art. 30 (key contractual provisions with ICT third-party providers) | Vendor incident requires contractual escalation and remediation | Invoke vendor notification/SLA clauses; require Fortinet root-cause and remediation evidence | | NIS2 Art. 21(2)(d) (supply chain security measures) | Fortinet is a critical ICT supplier; compromise affects downstream customers | Review supply-chain security measures covering Fortinet products and managed-service providers | | NIS2 Art. 23 (incident reporting obligations) | Significant incident with potential cross-border impact | Submit early warning, incident notification and final report to the CSIRT within NIS2 timelines | | UK NIS 2018 (OES/RDSP duties) | Operators of essential services or RDSPs running FortiGate | Apply OES/RDSP incident-handling and notification duties under the UK Regulations | ## 3\. Technical analysis & attack chain 1. **Reconnaissance** — Actor uses **Masscan** and **Shodan** to identify internet-exposed FortiGate appliances. Earliest artefacts date to **February 2026**; the operation has processed **1.16 billion credential attempts against 320,777 FortiGate targets** and **2.1 billion attempts against 163,650 MSSQL servers**. 2. **Initial access** — **SSH brute-force** against FortiGate management interfaces. The actor also targets Sophos SSL-VPN, RDWeb, Citrix SSL-VPN, RADIUS, NTLM and Kerberos endpoints. 3. **Sniffer deployment** — A custom **Golang-based tool dubbed "FortigateSniffer"** is deployed on the compromised device. It abuses a **legitimate FortiOS diagnostic command** to passively capture authentication traffic across **24 protocols**. SOCRadar assesses the tool was likely built with assistance from the AI-powered autonomous pentesting agent **"CyberStrike"**. 4. **Credential capture and exfiltration** — Captured cleartext credentials and password hashes are exfiltrated to attacker-controlled infrastructure. 5. **Offline cracking** — Hashes are cracked on a **45-GPU cluster managed via Hashtopolis**. Sixteen dictionaries curated specifically for FortiGate admin accounts are used. 6. **Validation and sale** — Cracked credentials are validated against target devices and consolidated into a working-credential database (currently 73,932–86,000 entries). 7. **Lateral movement** — Validated credentials are used to pivot into **Active Directory** domains and other internal services. On **15 June 2026**, the actor successfully cracked Kerberos hashes offline and immediately exfiltrated **DFS backup data from a NATO-aligned defence contractor**. 8. **Persistence and data theft** — Stolen **session cookies** are used to maintain persistent access. Sensitive data is exfiltrated from network shares. **Observed impact:** Verified working credentials for 73,932–86,000 FortiGate devices across 194 countries and 21,600+ domains; full network compromise reported at multiple organisations; exfiltration of classified defence documents from a Turkish NATO contractor. **Unconfirmed / single-sourced claims:** Attribution to a "Russian-speaking IAB" rests on researcher assessment (Volodymyr "Bob" Diachenko, SOCRadar) and linguistic/operational indicators; no MITRE ATT&CK group profile exists for this actor, so the attribution is **treated as unconfirmed**. The reported collaboration with Russian state-sponsored groups is speculative. The use of the AI agent "CyberStrike" to assist in building FortigateSniffer is an SOCRadar assessment, not confirmed by primary forensic evidence. ## 4\. Mitigation & containment ### P1 — within 24 hours (containment) - **Rotate all FortiGate administrator and SSL-VPN credentials** across every FortiGate device in the estate. Treat any device with an internet-exposed management or SSL-VPN interface as compromised until proven otherwise. - **Force password resets for any Active Directory, MSSQL, RADIUS, VPN and Citrix accounts** that share credentials with, or have authenticated through, a FortiGate device. - **Block / monitor the IP 85.11.187.8** (and the 85.11.187.0/24 range, AS211486) at the perimeter and in egress logs. - **Disable internet exposure** of FortiGate management interfaces (HTTPS/SSH) and SSL-VPN portals where operationally feasible; place behind a bastion or VPN concentrator. - **Enable MFA** on all FortiGate admin and SSL-VPN accounts. - **Invalidate existing sessions and session cookies** on FortiGate devices (CLI: `execute vpn sslvpn del-tunnel -all` and equivalent for admin sessions). ### P2 — within 72 hours (remediation) - **Upgrade FortiOS** to the latest vendor-supported version; review Fortinet PSIRT advisories for any out-of-cycle patches addressing the diagnostic-command abuse. - **Audit FortiGate logs** for: SSH brute-force source IPs (especially 85.11.187.8), HTTP activity on **port 9999**, and SSH/VNC/RDP sessions originating from 85.11.187.8 between **7 June 2026** (HTTP/9999) and **14–15 June 2026** (SSH/VNC/RDP). - **Search for the FortigateSniffer binary** on FortiGate filesystems and any Linux/Windows hosts used to manage them; check process listings for anomalous Golang binaries. - **Review MSSQL, AD, RADIUS and Kerberos authentication logs** for logons sourced from FortiGate management subnets or from the 85.11.187.0/24 range. - **Engage Fortinet support** under contractual escalation (DORA Art. 30) for root-cause analysis and confirmation of patched builds. ### P3 — within 7 days (hardening) - **Enforce MFA** across all admin and VPN access paths. - **Implement network segmentation** so that FortiGate management interfaces cannot reach AD, MSSQL or backup infrastructure directly. - **Conduct a third-party / concentration-risk review** of Fortinet footprint (DORA Art. 28, 29) and document remediation options. - **Add detection coverage** for the IOCs and behaviours listed in Sections 5 and 6. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | --------- | -------------------------------------------------------------------- | ---------- | ------------------------------------------------ | | ipv4 | 85.11.187.8 | High | Recorded Future Insikt, PwnDefend (corroborated) | | ipv4-cidr | 85.11.187.0/24 | Medium | Recorded Future Insikt | | asn | AS211486 | Medium | Recorded Future Insikt | | port | 9999/tcp (HTTP) | Medium | Recorded Future Insikt (observed 7 June 2026) | | tool | FortigateSniffer (Golang sniffer abusing FortiOS diagnostic command) | High | SOCRadar via SecurityWeek | | tool | CyberStrike (AI-assisted pentesting agent) | Low | SOCRadar assessment only | | tool | Masscan | High | SOCRadar via SecurityWeek | | tool | Hashtopolis | High | The Register / Diachenko | | tool | Shodan | High | SOCRadar via SecurityWeek | ```iocs ipv4 85.11.187.8 ipv4-cidr 85.11.187.0/24 asn AS211486 port 9999 tool FortigateSniffer tool CyberStrike tool Masscan tool Hashtopolis tool Shodan ``` ## 6\. Detection ```yara rule AT_FortiBleed_FortigateSniffer_Artefacts { meta: author = "Adverse Trace" date = "2026-06-23" description = "Strings associated with the FortiBleed campaign tooling and infrastructure" reference = "https://www.securityweek.com/russian-initial-access-broker-behind-fortibleed-campaign/" strings: $tool1 = "FortigateSniffer" ascii wide $tool2 = "CyberStrike" ascii wide $tool3 = "Hashtopolis" ascii wide $tool4 = "Masscan" ascii wide $ip1 = "85.11.187.8" ascii wide $asn1 = "AS211486" ascii wide condition: 2 of ($tool*, $ip1, $asn1) } ``` ```yaml title: FortiBleed — Outbound Network Activity to Known Campaign IP id: AT-2026-06-23-152-01 status: experimental description: | Detects outbound network connections from FortiGate management subnets or internal hosts to the IP 85.11.187.8 or the 85.11.187.0/24 range associated with the FortiBleed credential-harvesting campaign. author: Adverse Trace date: 2026-06-23 reference: https://www.recordedfuture.com/blog/critical-fortibleed-campaign logsource: product: firewall category: firewall detection: selection_dst_ip: dst_ip: - "85.11.187.8" selection_dst_cidr: dst_ip|cidr: "85.11.187.0/24" condition: selection_dst_ip or selection_dst_cidr fields: - src_ip - dst_ip - dst_port - action falsepositives: - None expected; legitimate traffic to this IP is highly unlikely level: high --- title: FortiBleed — HTTP Activity on Port 9999 from FortiGate Subnet id: AT-2026-06-23-152-02 status: experimental description: | Detects HTTP traffic on port 9999 originating from FortiGate management subnets, consistent with FortiBleed credential exfiltration observed on 7 June 2026. author: Adverse Trace date: 2026-06-23 reference: https://www.recordedfuture.com/blog/critical-fortibleed-campaign logsource: product: firewall detection: selection: dst_port: 9999 protocol: tcp filter_internal: src_ip|cidr: "10.0.0.0/8" # adjust to internal RFC1918 ranges condition: selection and filter_internal level: high ``` ## 7\. Sources - SecurityWeek — *Russian Initial Access Broker Behind FortiBleed Campaign* — https://www.securityweek.com/russian-initial-access-broker-behind-fortibleed-campaign/ — 23 June 2026 - BleepingComputer — *FortiBleed campaign used custom FortiGate sniffer to steal credentials* — https://www.bleepingcomputer.com/news/security/fortibleed-campaign-used-custom-fortigate-sniffer-to-steal-credentials/ — June 2026 - SecurityWeek — *Fortinet Responds to FortiBleed Campaign* — https://www.securityweek.com/fortinet-responds-to-fortibleed-campaign/ — June 2026 - Dark Reading — *FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist* — https://www.darkreading.com/cyberattacks-data-breaches/fortibleed-attackers-firewalls-credentials-stealers — June 2026 - DataBreaches.net — *Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries* (Arctic Wolf summary) — https://databreaches.net/2026/06/18/active-fortibleed-campaign-impacting-fortinet-devices-across-194-countries/ — 18 June 2026 - The Register — *Massive password-stealing attack hits 75k Fortinet firewalls* — https://www.theregister.com/cyber-crime/2026/06/17/massive-password-stealing-attack-hits-75k-fortinet-firewalls/5257877 — 17 June 2026 - Recorded Future Insikt — *FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems* — https://www.recordedfuture.com/blog/critical-fortibleed-campaign — 19 June 2026 ## 8\. Adverse Trace position **Severity:** High. The campaign combines a passive on-device sniffer with offline hash cracking at industrial scale, producing a verified working-credential database that covers tens of thousands of FortiGate devices — including those on recent FortiOS patches — across 194 countries. The blast radius for any EMEA financial services firm running FortiGate is direct: admin and SSL-VPN credentials must be assumed compromised, with downstream risk to Active Directory, MSSQL and any service sharing those credentials. **Client impact:** any client with an internet-exposed FortiGate management or SSL-VPN interface should be treated as in-scope until credential rotation and log review are complete. **Next steps:** Adverse Trace will (a) push the IOCs and detection rules in Sections 5–6 to client SOCs, (b) initiate DORA Art. 19 / NIS2 Art. 23 reporting workflows for affected financial entities, (c) request Fortinet root-cause and patched-build confirmation under DORA Art. 30, and (d) monitor for follow-on ransomware or state-actor activity leveraging the verified credential database. Attribution to a "Russian-speaking IAB" remains unconfirmed pending a MITRE ATT&CK group profile. --- [Read the original source →](https://www.securityweek.com/russian-initial-access-broker-behind-fortibleed-campaign/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*