{"id":1425,"date":"2026-06-23T20:17:51","date_gmt":"2026-06-23T20:17:51","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1425"},"modified":"2026-06-23T20:17:51","modified_gmt":"2026-06-23T20:17:51","slug":"fortibleed-targeted-fortigate-firewalls-in-110-million-credential-harvesting-operation","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1425","title":{"rendered":"FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jun 23, 2026<\/span><\/span>Initial Access Broker \/ Firewall Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A Russian-speaking initial access broker (IAB) driven by financial gain is assessed to be behind a large-scale credential-harvesting operation known as FortiBleed<\/b> that has targeted over 430,000 FortiGate firewalls globally.<\/p>\n

The campaign, active since February 2026, involves collecting credential lists, searching for exposed services, brute-forcing accessible systems, and deploying bespoke sniffers on compromised firewalls.<\/p>\n

\u00abOnce deployed, these sniffers capture cleartext and hashed credentials from traffic passing through compromised devices,\u00bb SOCRadar said<\/a> [PDF] in a fresh report. \u00abThe actors then crack, validate, and reuse the credentials against Active Directory domains and other exposed services.\u00bb<\/p>\n

Central to the operation is a Golang-based tool called FortigateSniffer <\/b>that takes advantage of the FortiOS built-in diagnostic command -diagnose sniffer packet to passively capture authentication traffic from the infected appliances. The tool is designed to monitor traffic across 24 protocols, parse authentication data, and extract the credentials.<\/p>\n

It’s suspected that the threat actors may have sought the help of an open-source, AI-native offensive security platform dubbed CyberStrike<\/a> to assist with some \u00abparts of the workflow.\u00bb Interestingly, another open-source framework called CyberStrikeAI was put to use in connection with another automated mass scanning campaign targeting FortiGate devices that Amazon Threat Intelligence exposed earlier this year.\u00a0<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abThe campaign shows a heavy focus on Small and Medium Businesses (SMBs) with fewer than 200 employees,\u00bb the SOCRadar explained. \u00abThe actor targets multiple sectors and regions, with notable emphasis on the United States and India. The IT services sector appears to be a key target. This targeting choice likely helps the actor maximize downstream access, as compromised service providers can create access paths into customer environments.\u00bb<\/p>\n

<\/p>\n

Perhaps the most interesting finding is that FortiBleed appears to be part of a broader, multi-vendor initial access operation that’s orchestrated to not only target Fortinet devices, but also breach Synology NAS, Sophos firewalls, RDWeb portals, Citrix SSL-VPNs, and MS-SQL servers using automated brute-forcing since February 28, 2026.<\/p>\n

\"\"<\/a><\/div>\n

In all, the attackers are estimated to have launched no less than 659 credential-harvesting pipelines on May 31 and June 15, 2026, resulting in the identification of over 110 million credentials. This included –<\/p>\n