#fortinet · 8sync News

FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation

A large-scale credential-harvesting campaign dubbed FortiBleed, attributed to a Russian-speaking initial access broker, has been targeting FortiGate firewalls since February 2026. The operation compromised over 430,000 devices globally using a Golang-based tool called FortigateSniffer, which abuses FortiOS's built-in diagnostic packet-sniffing capability to passively capture authentication traffic across 24 protocols. Over 110 million credentials were identified, including RADIUS credentials, NTLM hashes, Kerberos hashes, and MySQL tokens. Attackers then cracked and reused these credentials against Active Directory domains and other services. SMBs and IT service providers were primary targets. The campaign also extended to Synology NAS, Sophos firewalls, Citrix SSL-VPNs, and Microsoft SQL Server systems. CISOs are advised to rotate credentials, harden internet-facing access, enforce MFA, and hunt for signs of packet sniffing and lateral movement.

FortiBleed Attackers Turn Firewalls Into Credentials Stealers

SOCRadar has published a detailed whitepaper exposing the full attack chain behind the 'FortiBleed' campaign, a large-scale credential harvesting operation targeting over 430,000 FortiGate firewalls globally. Threat actors, likely Russian-speaking, deployed a Golang-based tool called FortigateSniffer that abuses FortiOS's built-in diagnostic commands to passively capture authentication traffic across 24 protocols without installing traditional malware. The campaign has already stolen over 110 million credentials including RADIUS, NTLM, and Kerberos material, created 659 credential-harvesting pipelines, and breached targets including a NATO-aligned defense contractor. The attack chain involves five steps: reconnaissance, credential stuffing/brute-force, passive sniffing post-compromise, hash cracking via GPU infrastructure, and lateral movement culminating in data theft or ransomware. CISA has urged organizations to harden Fortinet environments. Recommended mitigations include rotating all credentials, enforcing MFA, removing FortiGate management interfaces from internet exposure, and reviewing authentication logs.