Loading story…
The FBI and U.S. Secret Service warned that FortiBleed remains an active global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. Attackers use stolen credentials, credential harvesting, and brute-force attacks against devices with weak passwords and no multifactor authentication. They create administrator accounts, disable or delete legitimate accounts, and change passwords to lock owners out while maintaining persistence and attempting lateral movement. SOCRadar initially verified 86,644 compromised devices across 194 countries and later estimated that the wider operation targeted approximately 400,000–450,000 firewalls; those figures represent different measures of campaign scope.
Initial access brokers have used FortiBleed compromises to supply access to ransomware affiliates associated with INC/Lynx and Payload, turning gateway intrusions into potential enterprise ransomware incidents. The agencies warned that patching and password resets alone may be insufficient. Organizations should restrict internet-facing management access, terminate active sessions, reset administrative and VPN passwords, enforce strong passwords and phishing-resistant MFA, audit accounts and logs for unauthorized changes, and secure credential storage.
Map this exposure pattern across your cloud, code, and identities.
11 events from the most recent confirmed update back to the earliest known activity.
The FBI issued an advisory with the U.S. Secret Service warning that FortiBleed attackers manipulate administrator accounts to maintain access and lock out legitimate users, and that intrusions have provided initial access to INC/Lynx and Payload ransomware affiliates. The advisory included indicators of compromise and recommended restricting internet-facing administration, terminating sessions, resetting credentials, and enforcing phishing-resistant MFA.
CISA issued a FortiBleed warning alongside U.K. officials three months before the FBI and Secret Service advisory.
FortiBleed was first reported as a credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. Attackers used credential harvesting and brute-force attacks against devices with weak passwords and no multifactor authentication.
Researchers at threat-modeling.com reportedly described attackers combining stolen FortiBleed VPN credentials with exploitation of CVE-2026-39813 in FortiSandbox to obtain code execution and enable lateral movement.
SecurityWeek reports that the FortiBleed campaign was attributed to a Russian initial access broker. The article does not identify the broker by name or specify when the attribution occurred.
FortiBleed operators accidentally exposed their backend infrastructure through an open directory, allowing investigators to examine target selection, credential verification, and preparation of compromised access for sale. The investigation revealed GPU-accelerated password cracking using Hashcat and Hashtopolis and prioritization of targets by revenue and network structure.
SOCRadar reported in July that it had observed at least 12 confirmed ransomware attacks stemming from FortiBleed, documenting realized ransomware impact beyond compromised firewall and VPN access.
SOCRadar CISO Ensar Seker said a later investigation identified approximately 400,000–450,000 firewalls targeted by the wider operation. He cautioned that this targeting estimate and the initial compromised-device count measured different aspects of the campaign and were not directly comparable.
SOCRadar's initial investigation verified 86,644 compromised devices across 194 countries, establishing the campaign's global reach.
CSIRT Italia analyzed files released by the FortiBleed actor and identified evidence involving Italian assets and organizations in a dataset concerning Internet-exposed Fortinet/FortiGate SSL-VPN devices. The report did not name individual victims.
The reference identified Oracle, Comcast and Samsung as organizations involved in the FortiBleed credential-harvesting campaign exposed in June. The campaign leaked thousands of enterprise-level sign-in details.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
23 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourceinfosecurity-magazine.com
Open sourcesecurityweek.com
Open sourcebleepingcomputer.com
Open sourceacn.gov.it
Open sourcesdxcentral.com
Open sourceattack.mitre.org
Open sourceic3.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large-scale campaign dubbed **FortiBleed** harvested credentials from internet-facing Fortinet devices, with researchers reporting stolen data from more than 70,000 to 75,000 devices across up to 194 countries and evidence that more than 430,000 FortiGate firewalls were targeted. SOCRadar said the operators used default or previously leaked credentials to access devices, deployed a custom packet-sniffing implant known as **FortiGate Sniffer**, captured VPN and other authentication data in real time, and in some cases left persistent backdoor accounts such as `adminin`. Open-source reporting and government alerts also tied the activity to Fortinet flaws including `CVE-2024-55591`, `CVE-2025-59718`, and `CVE-2025-59719`, while Fortinet disputed claims that the exposed credentials reflected a new product breach and said some data may have come from earlier compromises or brute-force activity. The stolen access was allegedly linked to the **INC** and **Lynx** ransomware ecosystems, with researchers citing exposed infrastructure, ransomware negotiation-panel artifacts, credential-stuffing systems, and cases where intrusions progressed to encryption of hundreds of endpoints. Reports said credentials belonging to UK government officials, Foreign Office staff, embassy personnel, NHS trusts, local councils, energy firms, and pharmaceutical suppliers were offered for sale on dark-web forums, raising concern over follow-on attacks against sensitive networks. National defenders including the UK NCSC and Brazil's CTIR Gov urged organizations using Fortinet firewalls and SSL VPNs to review accounts, remove unauthorized users, terminate sessions, reset passwords, enforce MFA, patch affected systems, and inspect logs for signs of compromise and lateral movement.
Aug 15, 2026
Researchers and national defenders warned that **FortiBleed** has left more than **75,000 Fortinet firewall devices** compromised, exposing organizations worldwide through internet-facing security infrastructure. Hudson Rock first reported tens of thousands of affected Fortinet systems and later raised the estimate above 75,000, describing broad exposure across global enterprises and highlighting the scale of the compromise. CERT Bulgaria subsequently issued a public warning on FortiBleed, reinforcing that the incident affects a massive number of Fortinet firewall devices and poses a serious risk to exposed organizations. The combined reporting indicates a widespread compromise of perimeter security appliances, with impacted enterprises facing potential unauthorized access, data exposure, and downstream intrusion risk through trusted network defenses.
Aug 11, 2026
A dataset tied to the **FortiBleed** campaign exposed credentials associated with internet-facing Fortinet and FortiGate devices used for SSL-VPN remote access, affecting organizations in **194 countries**. Researchers reported that the collection grew from roughly **73,000** compromised devices to **86,644** firewalls and VPN gateways, and included VPN URLs, usernames, email addresses, and in many cases **plaintext passwords**. Italian authorities warned that the circulating dataset was specifically linked to exposed SSL-VPN credentials on internet-accessible Fortinet systems. Independent validation found that some leaked credentials were authentic and still worked on exposed devices, including systems running recent **FortiOS** versions. Investigators linked the database to active threat actors conducting large-scale scanning, compromising devices, intercepting traffic, and using stolen access to move into internal networks; some follow-on intrusions reportedly ended with ransomware-style encryption of hundreds of systems. Analysis also indicated that both default or built-in Fortinet accounts and organization-created accounts were present in the leak, pointing to weak credential hygiene and credential reuse as contributing factors, while the original intrusion vector remained unknown.
Aug 1, 2026