FortiBleed: Your Firewall Was Supposed to Stop Hackers — Instead It Became One

What Happened

our firewall sits at the edge of your network. It inspects every packet. It sees everything that comes in and everything that goes out. And for months, Russian-speaking hackers have been using exactly that privileged position to silently steal 110 million credentials from over 430,000 Fortinet FortiGate firewalls around the world.

The campaign, now dubbed FortiBleed, was first discovered on June 13, 2026 by security researcher Volodymyr ‘Bob’ Diachenko — who stumbled on an accidentally exposed threat-actor server sitting open on the internet. What he found inside was jaw-dropping: a fully automated, industrialized credential collection operation running 659 separate harvesting pipelines, targeting organizations in 194 countries, continuously, since at least February 2026.

ACTIVE THREAT: As of June 19, 2026, credentials from 86,644 unique FortiGate devices across 194 countries have been confirmed compromised. Roughly 19,000 devices are still being actively sniffed. There is no patch — this is a configuration and credential problem.

The Attack: A 5-Stage Industrial Operation

FortiBleed is not a smash-and-grab. It is a meticulously engineered, fully automated, multi-stage operation designed to maximize credential yield at scale.

⚑ Stage 1 — Reconnaissance

• Attackers used Masscan and Shodan to identify every internet-facing FortiGate device worldwide

• A custom tool called FortiProbe-fast filtered results to FortiGate-specific devices

• GeoSplit organized targets by country for systematic processing

⚑ Stage 2 — Initial Access via Brute Force

• A credential checker named ‘forticheck’ targeted FortiGate’s admin panel and SSL-VPN portal

• Dictionary attacks using 16 curated wordlists built specifically for FortiGate accounts

• Credential reuse from prior Fortinet breach databases and purchased credential dumps

• Result: 237,330 confirmed working FortiGate SSH credentials in ssh.txt

⚑ Stage 3 — Deploy the Sniffer

This is the most ingenious and dangerous part of the operation. Once SSH access was established, attackers deployed FortigateSniffer — a custom Golang tool that abuses FortiOS’s legitimate built-in diagnostic command: diagnose sniffer packet.

This feature was designed for network troubleshooting. Attackers repurposed it to silently intercept every credential passing through the firewall — 24 protocols, in real time, without triggering a single alarm.

• Protocols captured: NTLM, Kerberos, RADIUS, TACACS+, RPC, SMB, LDAP, SMTP, and 16 more

• Credentials intercepted from employees, VPN users, Active Directory authentications, and more

• All captured data streamed silently to attacker-controlled servers — no local staging

⚑ Stage 4 — Crack & Move Laterally

• NTLM and Kerberos hashes cracked via a Hashtopolis-managed Hashcat GPU cluster

• Additional GPU capacity dynamically rented from vast.ai, coordinated via Telegram bot

• Cracked credentials fed into Active Directory enumeration scripts (ad_enum.py, ad_full_audit.py)

• Password spraying tools (spray_da.py) moved across internal AD environments at scale

⚑ Stage 5 — Exfiltrate

• backup_dfs.py recursively extracted full DFS shares via SMB — streamed directly to attacker SSH servers

• On June 15, 2026: following offline cracking of 172 Kerberos RC4 hashes, attackers executed targeted DFS exfiltration from a NATO-aligned defense contractor

• Web session cookies were replayed to hijack authenticated sessions and maintain persistent access

Who Was Targeted?

FortiBleed is not a targeted campaign — it is an indiscriminate internet-wide sweep, but with deliberate victim prioritization based on business value.

Table summarizing cyberattack targets: small and medium businesses, IT and other sectors, notably a NATO defense contractor; main countries impacted include India; highlights hackers exploiting firewall vulnerability, with 430,000+ firms and 110,000 credentials affected.

Because the firewall sits at the network edge, a compromise there can expose an organization’s entire identity layer. The campaign reaches deep into supply chains, since MSPs and IT-services firms that manage Fortinet devices for others are squarely in the targeting. — SOCRadar

The Credential Storage Problem

Part of what made FortiBleed so effective was a latent vulnerability in how FortiGate stored credentials. Fortinet introduced stronger PBKDF2-based password hashing in FortiOS versions 7.2.11, 7.4.8, and 7.6.1 — replacing the older, weaker SHA-256 storage mechanism.

The problem: when organizations upgraded from earlier versions, existing administrator passwords remained stored as SHA-256 hashes until each administrator manually logged in after the upgrade. Many organizations never completed that step — leaving their credentials in a format attackers could crack quickly with GPU hardware.

What Has Been Done — Resolution Status

• CISA issued a FortiBleed hardening advisory on June 19, 2026, ordering federal agencies to take immediate action

• Fortinet identified potentially compromised systems and is proactively contacting impacted customers

• SOCRadar published a full report (PDF) with indicators of compromise, attack tools, and remediation guidance

• Hudson Rock and Kevin Beaumont validated portions of the dataset; a searchable victim lookup was made available to organizations to check domain exposure

• IMPORTANT: There is no patch. FortiBleed exploits legitimate functionality (SSH brute force + diagnostic commands). The fix is hardening and credential rotation.