Loading story…
A dataset tied to the FortiBleed campaign exposed credentials associated with internet-facing Fortinet and FortiGate devices used for SSL-VPN remote access, affecting organizations in 194 countries. Researchers reported that the collection grew from roughly 73,000 compromised devices to 86,644 firewalls and VPN gateways, and included VPN URLs, usernames, email addresses, and in many cases plaintext passwords. Italian authorities warned that the circulating dataset was specifically linked to exposed SSL-VPN credentials on internet-accessible Fortinet systems.
Independent validation found that some leaked credentials were authentic and still worked on exposed devices, including systems running recent FortiOS versions. Investigators linked the database to active threat actors conducting large-scale scanning, compromising devices, intercepting traffic, and using stolen access to move into internal networks; some follow-on intrusions reportedly ended with ransomware-style encryption of hundreds of systems. Analysis also indicated that both default or built-in Fortinet accounts and organization-created accounts were present in the leak, pointing to weak credential hygiene and credential reuse as contributing factors, while the original intrusion vector remained unknown.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-19, CISA warned that credentials exposed in the FortiBleed leak were already being actively used in intrusion campaigns against FortiGate targets. The warning marked an escalation from credential exposure to observed malicious use of the leaked data.
On 2026-06-10, CSIRT Italia published a bulletin reporting the circulation of a dataset linked to the “FortiBleed” campaign. The dataset was described as containing information associated with internet-exposed Fortinet/FortiGate SSL-VPN devices and exposed credentials tied to those systems.
In June 2026, security researcher Bob Diachenko discovered an exposed server holding a large database of FortiGate and Fortinet VPN URLs, usernames, email addresses, and plaintext passwords. The leak was later described as affecting tens of thousands of devices worldwide.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecert.pa
Open sourcecolcert.gov.co
Open sourceacn.gov.it
Open sourcedocs.fortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large-scale campaign dubbed **FortiBleed** exploited weak security on Fortinet FortiGate devices to steal credentials and gain access to government and corporate networks worldwide. Researchers said the operators scanned internet-exposed FortiGate portals, logged in with default or previously leaked credentials, and in many cases deployed a Go-based sniffer known as `FortigateSniffer` to intercept traffic and harvest additional logins. SOCRadar estimated that more than **430,000** FortiGate firewalls were targeted, over **110 million** credentials were collected, and about **12,000** devices were implanted, with activity observed across more than 150 countries. The stolen access was then used for deeper intrusions, including attacks tied to the **INC Ransom** and **Lynx** ransomware groups. Researchers reported that 354 compromises progressed into victim environments and at least 12 cases ended in ransomware deployment that encrypted hundreds of endpoints. In the UK, exposed accounts reportedly included Foreign Office staff, embassy personnel in Thailand and Mauritius, and local government officials, while organizations linked to the NHS, energy providers, and pharmaceutical suppliers were also affected; some stolen credentials were allegedly offered for sale on criminal forums by a user called **"SantaAd."** The UK National Cyber Security Centre said it was tracking ongoing brute-force activity against Fortinet devices and urged organizations to inspect networks, isolate compromised systems, and reset passwords.
Jul 10, 2026
A large-scale credential-harvesting campaign has compromised more than **30,000 Fortinet FortiGate firewalls and VPN gateways** across **194 countries**, according to SOCRadar, which said the attackers amassed a database of **30,791 verified working credentials**. Researchers said the operation targeted internet-facing Fortinet management and VPN interfaces using **credential stuffing, password spraying, brute-force attempts, and reused passwords from prior leaks**, and found **no evidence of a Fortinet zero-day or a breach of Fortinet itself**. The attackers allegedly used compromised devices as listening posts to capture additional credentials and feed them into an automated attack chain, broadening access across sectors including **telecommunications, government, healthcare, finance, education, energy, and other critical infrastructure**. Telecom was reported as the most affected sector, while government entities accounted for **591 entries across 111 domains**; **India and the United States** represented nearly one-third of identified compromises. SOCRadar said the campaign remained active and assessed it as **critical**, with tooling and victim selection described as consistent with **Russian-speaking threat actors** and possible motives spanning both **financial gain and cyberespionage**.
Jul 23, 2026
Attackers have been actively targeting internet-exposed **Fortinet FortiGate** management interfaces to seize administrative control of firewalls, with reporting tying the activity to exploitation of **`CVE-2024-55591`** and a related authentication weakness, **`CVE-2025-24472`**. Fortinet said the primary flaw affects **FortiOS** and **FortiProxy** and stems from improper authentication in the Node.js websocket module, allowing an unauthenticated remote attacker to obtain **super-admin** access and full control of vulnerable devices. Observed intrusions included the creation of new administrator accounts, adding those accounts to **SSL VPN** groups, changing firewall policies, and using the compromised appliances to pivot into networks that were otherwise protected behind the VPN perimeter. Security guidance accompanying the disclosures urged organizations to apply Fortinet patches immediately, disable or restrict public exposure of management interfaces, harden FortiOS devices, and review logs for signs of compromise tied to the broader campaign against exposed firewall consoles.
Jul 24, 2026