Loading story…
A large-scale campaign dubbed FortiBleed exploited weak security on Fortinet FortiGate devices to steal credentials and gain access to government and corporate networks worldwide. Researchers said the operators scanned internet-exposed FortiGate portals, logged in with default or previously leaked credentials, and in many cases deployed a Go-based sniffer known as FortigateSniffer to intercept traffic and harvest additional logins. SOCRadar estimated that more than 430,000 FortiGate firewalls were targeted, over 110 million credentials were collected, and about 12,000 devices were implanted, with activity observed across more than 150 countries.
The stolen access was then used for deeper intrusions, including attacks tied to the INC Ransom and Lynx ransomware groups. Researchers reported that 354 compromises progressed into victim environments and at least 12 cases ended in ransomware deployment that encrypted hundreds of endpoints. In the UK, exposed accounts reportedly included Foreign Office staff, embassy personnel in Thailand and Mauritius, and local government officials, while organizations linked to the NHS, energy providers, and pharmaceutical suppliers were also affected; some stolen credentials were allegedly offered for sale on criminal forums by a user called "SantaAd." The UK National Cyber Security Centre said it was tracking ongoing brute-force activity against Fortinet devices and urged organizations to inspect networks, isolate compromised systems, and reset passwords.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The UK National Cyber Security Centre confirmed ongoing brute-force activity targeting Fortinet devices and advised organizations to inspect networks, isolate compromised devices, and reset passwords. The notice was presented as an official response to the activity described in the reporting.
Reporting said the campaign led to the theft of email accounts and credentials belonging to UK government officials, Foreign Office staff, embassy personnel in Thailand and Mauritius, and local government officials in Derbyshire and Waltham Forest. The article also said credentials tied to organizations linked to the NHS, energy companies, and pharmaceutical suppliers were being offered for sale on illicit forums by a user named "SantaAd."
SOCRadar linked the FortiBleed campaign to the INC Ransom and Lynx ransomware groups, saying credentials stolen from FortiGate devices were later used to penetrate corporate networks and deploy ransomware. The researchers said 12 observed cases ended in ransomware deployment that encrypted hundreds of endpoints.
SOCRadar researchers reported finding an internet-exposed server containing stolen credentials from more than 73,000 Fortinet devices, FortiGate configuration files, and infrastructure used for hash cracking and credential stuffing. The same reporting said the broader campaign targeted over 430,000 FortiGate firewalls globally and identified persistent backdoor accounts named "adminin."
SOCRadar reported that the large-scale FortiBleed campaign had been active since at least February 2026. The operators allegedly scanned the internet for FortiGate devices, logged in with default or previously leaked credentials, and installed a Go-based sniffer called FortigateSniffer to intercept traffic and harvest credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceitpro.com
Open sourceeuronews.al
Open sourcexakep.ru
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large-scale credential-harvesting campaign has compromised more than **30,000 Fortinet FortiGate firewalls and VPN gateways** across **194 countries**, according to SOCRadar, which said the attackers amassed a database of **30,791 verified working credentials**. Researchers said the operation targeted internet-facing Fortinet management and VPN interfaces using **credential stuffing, password spraying, brute-force attempts, and reused passwords from prior leaks**, and found **no evidence of a Fortinet zero-day or a breach of Fortinet itself**. The attackers allegedly used compromised devices as listening posts to capture additional credentials and feed them into an automated attack chain, broadening access across sectors including **telecommunications, government, healthcare, finance, education, energy, and other critical infrastructure**. Telecom was reported as the most affected sector, while government entities accounted for **591 entries across 111 domains**; **India and the United States** represented nearly one-third of identified compromises. SOCRadar said the campaign remained active and assessed it as **critical**, with tooling and victim selection described as consistent with **Russian-speaking threat actors** and possible motives spanning both **financial gain and cyberespionage**.
Jul 23, 2026
A dataset tied to the **FortiBleed** campaign exposed credentials associated with internet-facing Fortinet and FortiGate devices used for SSL-VPN remote access, affecting organizations in **194 countries**. Researchers reported that the collection grew from roughly **73,000** compromised devices to **86,644** firewalls and VPN gateways, and included VPN URLs, usernames, email addresses, and in many cases **plaintext passwords**. Italian authorities warned that the circulating dataset was specifically linked to exposed SSL-VPN credentials on internet-accessible Fortinet systems. Independent validation found that some leaked credentials were authentic and still worked on exposed devices, including systems running recent **FortiOS** versions. Investigators linked the database to active threat actors conducting large-scale scanning, compromising devices, intercepting traffic, and using stolen access to move into internal networks; some follow-on intrusions reportedly ended with ransomware-style encryption of hundreds of systems. Analysis also indicated that both default or built-in Fortinet accounts and organization-created accounts were present in the leak, pointing to weak credential hygiene and credential reuse as contributing factors, while the original intrusion vector remained unknown.
Aug 1, 2026
SentinelOne DFIR reported multiple intrusions in which threat actors compromised **FortiGate Next-Generation Firewall (NGFW)** appliances to gain an initial foothold, then extracted FortiGate configuration files containing **service account credentials** and **network topology** data. The activity targeted organizations including **healthcare, government, and managed service providers**, and in several cases was detected during the lateral-movement stage before full domain compromise. SentinelOne noted that many affected environments lacked sufficient FortiGate logging, limiting defenders’ ability to determine the exact initial access vector and timeline; observed dwell time from perimeter compromise to follow-on internal activity ranged from **months to near-immediate** escalation. The intrusions were assessed as enabled by exploitation of **recently disclosed Fortinet vulnerabilities** and/or weak or misconfigured access controls on edge devices. Reported candidate vulnerabilities included `CVE-2025-59718`, `CVE-2025-59719`, and `CVE-2026-24858`, which could allow unauthorized access and facilitate configuration theft. In one investigated case, attackers created a new local administrator account named **"support"** on a compromised FortiGate and added permissive firewall policies to allow broad, unrestricted traversal across zones—behavior consistent with establishing durable access and potentially supporting **initial access broker (IAB)**-style operations that enable deeper **Active Directory** compromise via stolen directory-connected service accounts.
Jun 29, 2026