Loading story…
Researchers and national defenders warned that FortiBleed has left more than 75,000 Fortinet firewall devices compromised, exposing organizations worldwide through internet-facing security infrastructure. Hudson Rock first reported tens of thousands of affected Fortinet systems and later raised the estimate above 75,000, describing broad exposure across global enterprises and highlighting the scale of the compromise.
CERT Bulgaria subsequently issued a public warning on FortiBleed, reinforcing that the incident affects a massive number of Fortinet firewall devices and poses a serious risk to exposed organizations. The combined reporting indicates a widespread compromise of perimeter security appliances, with impacted enterprises facing potential unauthorized access, data exposure, and downstream intrusion risk through trusted network defenses.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The UK National Cyber Security Centre issued guidance for organizations affected by the FortiBleed credential theft campaign, warning that some victims may already have suffered full network compromise. It advised customers to check exposure, isolate affected devices, reset and investigate them, and harden rebuilt systems with updates, MFA, unique passwords, and PBKDF2.
CERT Bulgaria published a warning about FortiBleed, citing more than 75,000 compromised Fortinet firewall devices after the attack. The notice reflects official government CERT amplification of the reported incident.
A later Hudson Rock report said the number of compromised Fortinet firewalls had risen to 75,000 and described global enterprises as exposed. This represents an escalation in the reported scale of the incident.
Hudson Rock published a FortiBleed report stating that more than 73,932 Fortinet firewall devices had been compromised. The report framed the issue as exposing organizations through infected firewall appliances.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcegovcert.bg
Open sourcehudsonrock.com
Open sourcehudsonrock.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A dataset tied to the **FortiBleed** campaign exposed credentials associated with internet-facing Fortinet and FortiGate devices used for SSL-VPN remote access, affecting organizations in **194 countries**. Researchers reported that the collection grew from roughly **73,000** compromised devices to **86,644** firewalls and VPN gateways, and included VPN URLs, usernames, email addresses, and in many cases **plaintext passwords**. Italian authorities warned that the circulating dataset was specifically linked to exposed SSL-VPN credentials on internet-accessible Fortinet systems. Independent validation found that some leaked credentials were authentic and still worked on exposed devices, including systems running recent **FortiOS** versions. Investigators linked the database to active threat actors conducting large-scale scanning, compromising devices, intercepting traffic, and using stolen access to move into internal networks; some follow-on intrusions reportedly ended with ransomware-style encryption of hundreds of systems. Analysis also indicated that both default or built-in Fortinet accounts and organization-created accounts were present in the leak, pointing to weak credential hygiene and credential reuse as contributing factors, while the original intrusion vector remained unknown.
Aug 1, 2026
A large-scale campaign dubbed **FortiBleed** harvested credentials from internet-facing Fortinet devices, with researchers reporting stolen data from more than 70,000 to 75,000 devices across up to 194 countries and evidence that more than 430,000 FortiGate firewalls were targeted. SOCRadar said the operators used default or previously leaked credentials to access devices, deployed a custom packet-sniffing implant known as **FortiGate Sniffer**, captured VPN and other authentication data in real time, and in some cases left persistent backdoor accounts such as `adminin`. Open-source reporting and government alerts also tied the activity to Fortinet flaws including `CVE-2024-55591`, `CVE-2025-59718`, and `CVE-2025-59719`, while Fortinet disputed claims that the exposed credentials reflected a new product breach and said some data may have come from earlier compromises or brute-force activity. The stolen access was allegedly linked to the **INC** and **Lynx** ransomware ecosystems, with researchers citing exposed infrastructure, ransomware negotiation-panel artifacts, credential-stuffing systems, and cases where intrusions progressed to encryption of hundreds of endpoints. Reports said credentials belonging to UK government officials, Foreign Office staff, embassy personnel, NHS trusts, local councils, energy firms, and pharmaceutical suppliers were offered for sale on dark-web forums, raising concern over follow-on attacks against sensitive networks. National defenders including the UK NCSC and Brazil's CTIR Gov urged organizations using Fortinet firewalls and SSL VPNs to review accounts, remove unauthorized users, terminate sessions, reset passwords, enforce MFA, patch affected systems, and inspect logs for signs of compromise and lateral movement.
Aug 15, 2026
A large-scale credential-harvesting campaign has compromised more than **30,000 Fortinet FortiGate firewalls and VPN gateways** across **194 countries**, according to SOCRadar, which said the attackers amassed a database of **30,791 verified working credentials**. Researchers said the operation targeted internet-facing Fortinet management and VPN interfaces using **credential stuffing, password spraying, brute-force attempts, and reused passwords from prior leaks**, and found **no evidence of a Fortinet zero-day or a breach of Fortinet itself**. The attackers allegedly used compromised devices as listening posts to capture additional credentials and feed them into an automated attack chain, broadening access across sectors including **telecommunications, government, healthcare, finance, education, energy, and other critical infrastructure**. Telecom was reported as the most affected sector, while government entities accounted for **591 entries across 111 domains**; **India and the United States** represented nearly one-third of identified compromises. SOCRadar said the campaign remained active and assessed it as **critical**, with tooling and victim selection described as consistent with **Russian-speaking threat actors** and possible motives spanning both **financial gain and cyberespionage**.
Jul 23, 2026