Belsen Group
Belsen Group is a cybercriminal initial access broker and leak actor associated with large-scale compromise of Fortinet FortiGate devices. The group gained notoriety for leaking configurations from over 15,000 compromised FortiGate firewalls, with reporting stating that a 2022 zero-day was used to dump the configurations and that the data was published later in 2025. Reporting also states the group offered remote code execution/network access to victims, including advertised access to the “largest energy company in North Africa,” and that it transitioned from publishing exposed data to directly monetizing corporate network access for thousands of dollars. In the provided content, Belsen Group is specifically linked to FortiGate configuration leaks, resale of high-value access, and broader access-broker activity. No additional aliases or sub-groups are identified beyond the name Belsen Group.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a group that published a prior batch of leaked Fortinet credentials tied to a 2022 zero-day, providing historical credential material later reused in the FortiBleed campaign.
Associated with a prior incident in which a 2022 zero-day was used to dump Fortigate firewall configurations, later published in 2025.
Initial Access Broker (IAB) specializing in monetizing access to corporate networks by compromising edge devices, notably Fortinet FortiGate appliances.
Illicit access broker/data broker group selling network access (including claimed RCE) to energy-sector targets; associated with large-scale FortiGate configuration leaks.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.