Russian Initial Access Broker Behind FortiBleed Campaign

1. Executive summary

A financially motivated, Russian-speaking initial access broker (IAB) has been conducting a large-scale credential-harvesting campaign — dubbed FortiBleed — against internet-exposed Fortinet FortiGate firewalls since at least February 2026. The actor uses a custom Golang sniffer ("FortigateSniffer") that abuses a legitimate FortiOS diagnostic command to passively capture authentication traffic across 24 protocols, then cracks harvested hashes offline on a 45-GPU Hashtopolis cluster. SOCRadar estimates more than 110 million credentials have been captured, with a verified working-credential database covering 73,932–86,000 FortiGate devices across 194 countries and 21,600+ domains. Affected sectors include financial services, government, telecommunications, healthcare, manufacturing and critical infrastructure; named victims include Foxconn, Samsung, Comcast, Siemens, Lenovo, FedEx, Accenture and Oracle, plus a Turkish NATO defence contractor from which classified documents were exfiltrated. Bottom-line risk for EMEA financial services: any organisation running FortiGate with an internet-exposed management or SSL-VPN interface should treat its admin and VPN credentials as compromised until proven otherwise, rotate immediately, and audit for follow-on Active Directory and MSSQL activity.

2. Regulatory framing

3. Technical analysis & attack chain

1. Reconnaissance — Actor uses Masscan and Shodan to identify internet-exposed FortiGate appliances. Earliest artefacts date to February 2026; the operation has processed 1.16 billion credential attempts against 320,777 FortiGate targets and 2.1 billion attempts against 163,650 MSSQL servers.
2. Initial access — SSH brute-force against FortiGate management interfaces. The actor also targets Sophos SSL-VPN, RDWeb, Citrix SSL-VPN, RADIUS, NTLM and Kerberos endpoints.
3. Sniffer deployment — A custom Golang-based tool dubbed "FortigateSniffer" is deployed on the compromised device. It abuses a legitimate FortiOS diagnostic command to passively capture authentication traffic across 24 protocols. SOCRadar assesses the tool was likely built with assistance from the AI-powered autonomous pentesting agent "CyberStrike".
4. Credential capture and exfiltration — Captured cleartext credentials and password hashes are exfiltrated to attacker-controlled infrastructure.
5. Offline cracking — Hashes are cracked on a 45-GPU cluster managed via Hashtopolis. Sixteen dictionaries curated specifically for FortiGate admin accounts are used.
6. Validation and sale — Cracked credentials are validated against target devices and consolidated into a working-credential database (currently 73,932–86,000 entries).
7. Lateral movement — Validated credentials are used to pivot into Active Directory domains and other internal services. On 15 June 2026, the actor successfully cracked Kerberos hashes offline and immediately exfiltrated DFS backup data from a NATO-aligned defence contractor.
8. Persistence and data theft — Stolen session cookies are used to maintain persistent access. Sensitive data is exfiltrated from network shares.

Observed impact: Verified working credentials for 73,932–86,000 FortiGate devices across 194 countries and 21,600+ domains; full network compromise reported at multiple organisations; exfiltration of classified defence documents from a Turkish NATO contractor.

Unconfirmed / single-sourced claims: Attribution to a "Russian-speaking IAB" rests on researcher assessment (Volodymyr "Bob" Diachenko, SOCRadar) and linguistic/operational indicators; no MITRE ATT&CK group profile exists for this actor, so the attribution is treated as unconfirmed. The reported collaboration with Russian state-sponsored groups is speculative. The use of the AI agent "CyberStrike" to assist in building FortigateSniffer is an SOCRadar assessment, not confirmed by primary forensic evidence.

4. Mitigation & containment

P1 — within 24 hours (containment)

• Rotate all FortiGate administrator and SSL-VPN credentials across every FortiGate device in the estate. Treat any device with an internet-exposed management or SSL-VPN interface as compromised until proven otherwise.
• Force password resets for any Active Directory, MSSQL, RADIUS, VPN and Citrix accounts that share credentials with, or have authenticated through, a FortiGate device.
• Block / monitor the IP 85.11.187.8 (and the 85.11.187.0/24 range, AS211486) at the perimeter and in egress logs.
• Disable internet exposure of FortiGate management interfaces (HTTPS/SSH) and SSL-VPN portals where operationally feasible; place behind a bastion or VPN concentrator.
• Enable MFA on all FortiGate admin and SSL-VPN accounts.
• Invalidate existing sessions and session cookies on FortiGate devices (CLI: execute vpn sslvpn del-tunnel -all and equivalent for admin sessions).

P2 — within 72 hours (remediation)

• Upgrade FortiOS to the latest vendor-supported version; review Fortinet PSIRT advisories for any out-of-cycle patches addressing the diagnostic-command abuse.
• Audit FortiGate logs for: SSH brute-force source IPs (especially 85.11.187.8), HTTP activity on port 9999, and SSH/VNC/RDP sessions originating from 85.11.187.8 between 7 June 2026 (HTTP/9999) and 14–15 June 2026 (SSH/VNC/RDP).
• Search for the FortigateSniffer binary on FortiGate filesystems and any Linux/Windows hosts used to manage them; check process listings for anomalous Golang binaries.
• Review MSSQL, AD, RADIUS and Kerberos authentication logs for logons sourced from FortiGate management subnets or from the 85.11.187.0/24 range.
• Engage Fortinet support under contractual escalation (DORA Art. 30) for root-cause analysis and confirmation of patched builds.

P3 — within 7 days (hardening)

• Enforce MFA across all admin and VPN access paths.
• Implement network segmentation so that FortiGate management interfaces cannot reach AD, MSSQL or backup infrastructure directly.
• Conduct a third-party / concentration-risk review of Fortinet footprint (DORA Art. 28, 29) and document remediation options.
• Add detection coverage for the IOCs and behaviours listed in Sections 5 and 6.

5. Indicators of compromise

ipv4  85.11.187.8
ipv4-cidr  85.11.187.0/24
asn  AS211486
port  9999
tool  FortigateSniffer
tool  CyberStrike
tool  Masscan
tool  Hashtopolis
tool  Shodan

6. Detection

rule AT_FortiBleed_FortigateSniffer_Artefacts
{
    meta:
        author = "Adverse Trace"
        date = "2026-06-23"
        description = "Strings associated with the FortiBleed campaign tooling and infrastructure"
        reference = "https://www.securityweek.com/russian-initial-access-broker-behind-fortibleed-campaign/"

    strings:
        $tool1 = "FortigateSniffer" ascii wide
        $tool2 = "CyberStrike" ascii wide
        $tool3 = "Hashtopolis" ascii wide
        $tool4 = "Masscan" ascii wide
        $ip1   = "85.11.187.8" ascii wide
        $asn1  = "AS211486" ascii wide

    condition:
        2 of ($tool*, $ip1, $asn1)
}

title: FortiBleed — Outbound Network Activity to Known Campaign IP
id: AT-2026-06-23-152-01
status: experimental
description: |
  Detects outbound network connections from FortiGate management subnets or
  internal hosts to the IP 85.11.187.8 or the 85.11.187.0/24 range associated
  with the FortiBleed credential-harvesting campaign.
author: Adverse Trace
date: 2026-06-23
reference: https://www.recordedfuture.com/blog/critical-fortibleed-campaign
logsource:
  product: firewall
  category: firewall
detection:
  selection_dst_ip:
    dst_ip:

      - "85.11.187.8"
  selection_dst_cidr:
    dst_ip|cidr: "85.11.187.0/24"
  condition: selection_dst_ip or selection_dst_cidr
fields:

  - src_ip
  - dst_ip
  - dst_port
  - action
falsepositives:

  - None expected; legitimate traffic to this IP is highly unlikely
level: high
---
title: FortiBleed — HTTP Activity on Port 9999 from FortiGate Subnet
id: AT-2026-06-23-152-02
status: experimental
description: |
  Detects HTTP traffic on port 9999 originating from FortiGate management
  subnets, consistent with FortiBleed credential exfiltration observed on
  7 June 2026.
author: Adverse Trace
date: 2026-06-23
reference: https://www.recordedfuture.com/blog/critical-fortibleed-campaign
logsource:
  product: firewall
detection:
  selection:
    dst_port: 9999
    protocol: tcp
  filter_internal:
    src_ip|cidr: "10.0.0.0/8"  # adjust to internal RFC1918 ranges
  condition: selection and filter_internal
level: high

7. Sources

• SecurityWeek — Russian Initial Access Broker Behind FortiBleed Campaign — https://www.securityweek.com/russian-initial-access-broker-behind-fortibleed-campaign/ — 23 June 2026
• BleepingComputer — FortiBleed campaign used custom FortiGate sniffer to steal credentials — https://www.bleepingcomputer.com/news/security/fortibleed-campaign-used-custom-fortigate-sniffer-to-steal-credentials/ — June 2026
• SecurityWeek — Fortinet Responds to FortiBleed Campaign — https://www.securityweek.com/fortinet-responds-to-fortibleed-campaign/ — June 2026
• Dark Reading — FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist — https://www.darkreading.com/cyberattacks-data-breaches/fortibleed-attackers-firewalls-credentials-stealers — June 2026
• DataBreaches.net — Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries (Arctic Wolf summary) — https://databreaches.net/2026/06/18/active-fortibleed-campaign-impacting-fortinet-devices-across-194-countries/ — 18 June 2026
• The Register — Massive password-stealing attack hits 75k Fortinet firewalls — https://www.theregister.com/cyber-crime/2026/06/17/massive-password-stealing-attack-hits-75k-fortinet-firewalls/5257877 — 17 June 2026
• Recorded Future Insikt — FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems — https://www.recordedfuture.com/blog/critical-fortibleed-campaign — 19 June 2026

8. Adverse Trace position

Severity: High. The campaign combines a passive on-device sniffer with offline hash cracking at industrial scale, producing a verified working-credential database that covers tens of thousands of FortiGate devices — including those on recent FortiOS patches — across 194 countries. The blast radius for any EMEA financial services firm running FortiGate is direct: admin and SSL-VPN credentials must be assumed compromised, with downstream risk to Active Directory, MSSQL and any service sharing those credentials. Client impact: any client with an internet-exposed FortiGate management or SSL-VPN interface should be treated as in-scope until credential rotation and log review are complete. Next steps: Adverse Trace will (a) push the IOCs and detection rules in Sections 5–6 to client SOCs, (b) initiate DORA Art. 19 / NIS2 Art. 23 reporting workflows for affected financial entities, (c) request Fortinet root-cause and patched-build confirmation under DORA Art. 30, and (d) monitor for follow-on ransomware or state-actor activity leveraging the verified credential database. Attribution to a "Russian-speaking IAB" remains unconfirmed pending a MITRE ATT&CK group profile.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.