SantaAd

SantaAd is a Russian-speaking initial access broker associated with large-scale acquisition and resale of access to internet-facing enterprise systems, especially Fortinet FortiGate and FortiOS SSL-VPN environments. The actor has been linked to the FortiBleed operation, a broad credential-harvesting and access-brokering campaign that combined internet-wide scanning, brute-force and credential-based intrusion, validation of stolen access, enrichment of victim metadata, and resale-oriented monetization. Reporting characterizes SantaAd as operating in Russian-speaking cybercrime ecosystems and advertising bulk access to compromised Fortinet devices for sale to ransomware operators and other criminal buyers. SantaAd’s activity is centered on obtaining validated remote access at scale rather than deploying bespoke malware for destructive or espionage purposes. Observed tradecraft includes reconnaissance and scanning of exposed services, brute-force and dictionary attacks, use of credentials from prior leaks and infostealer collections, cracking of FortiOS administrative password hashes with rented GPU infrastructure, and abuse of legitimate device functionality for post-compromise credential collection. In Fortinet-focused intrusions, compromised edge devices were reportedly used as passive collection points to capture authentication material traversing the network, including plaintext credentials, Kerberos material, NTLM-related data, and session artifacts. The actor has also been associated with replay of session cookies to maintain or regain access. The operation attributed to SantaAd expanded beyond Fortinet products to include other exposed enterprise technologies such as network-attached storage, firewalls, remote access portals, and database services. Victim data was reportedly enriched with organizational attributes including sector, revenue, and employee count, indicating a brokerage model designed to increase resale value. Available evidence indicates opportunistic, high-volume targeting with particular interest in small and mid-sized organizations and IT service providers, including managed service providers, whose compromise could enable downstream access to customer environments. Post-compromise behavior linked to the broader campaign includes credential harvesting, Active Directory reconnaissance, lateral movement, access to internal file shares, and exfiltration of victim data. SantaAd has been publicly associated with auctions and sale listings for large volumes of Fortinet access on a Russian-speaking underground forum, and has been described as a multi-operator group by some researchers. The dominant assessed motivation is financial gain through access brokerage, including sales to ransomware affiliates and other cybercriminal actors.