The IT Nerd

After several days spent reverse-engineering the attacker’s environment, the SOCRadar research team has published a new, in-depth technical analysis on the FortiBleed campaign, including the attacker’s infrastructure, tooling, and methods.

Summary:

FortiBleed is a large-scale, still-active credential-harvesting campaign targeting internet-facing Fortinet FortiGate firewalls — hundreds of thousands of devices in scope worldwide. It is important to state plainly what it is not: this is not a zero-day or a newly disclosed software vulnerability. It is a credential and access operation. Attackers compromise exposed firewalls, harvest the authentication traffic and credentials passing through them, crack what they capture, and sell that access on. The actor fits the profile of a financially-motivated initial access broker — the kind whose intrusions become the front end of someone else’s ransomware or data-extortion event.

Why it matters — and the number to focus on. At the time of writing, more than 19,000 FortiGate devices were still being actively sniffed by the attackers — part of a broader 80,553 identified targets. That present tense is the point: this is not a historical data dump to clean up after, but a live operation, running since at least February 2026, quietly capturing authentication traffic as users log in each day. Because the firewall sits at the network edge, a compromise there can expose an organization’s entire identity layer — and the campaign reaches deep into supply chains, since MSPs and IT-services firms that manage Fortinet devices for others are squarely in the targeting.

What’s new in this report:

• A custom Golang tool (“FortigateSniffer”) that abuses a legitimate FortiOS diagnostic command to passively capture authentication traffic from a compromised firewall — leaving no malware behind and largely evading traditional detection.
• Targeting beyond Fortinet. The attacker’s own infrastructure contained reconnaissance/target lists for other edge platforms — a 29,270-entry Citrix login-URL list and roughly 247,584 Sophos SSL-VPN portals — showing the operation’s scanning was multi-vendor, not Fortinet-exclusive. (To be precise: these are targeting artifacts; we did not find captured credentials for the Citrix or Sophos tracks, so we characterize them as in-scope for reconnaissance rather than confirmed compromise.)
• Attacker infrastructure far larger than the single exposed server first reported — 150+ servers — plus the operators’ use of rented GPU compute and agentic tooling.

What goes deeper: The report maps the full attack chain end to end — reconnaissance, initial access, credential cracking, lateral movement into Active Directory, and exfiltration — with indicators of compromise, file hashes, a MITRE ATT&CK mapping, and the attribution clues pointing to a Russian-speaking access broker.

What it corroborates: Several findings independently align with other published research, which we think is worth noting rather than glossing over: the Sophos figure (~247,584) matches what others observed, as do the scale of the MSSQL brute-forcing and the confirmed deep intrusion at a defense contractor. Where the picture is still uncertain — full attribution, for instance — is noted as well.

To view the full report, see Dismantling FortiBleed: Inside a Russian Fortinet Compromise Operation 

The disclosure of the FortiBleed data leak is a reminder that security risks don’t always stem from active exploitation or newly discovered vulnerabilities. Large-scale exposures of device information, configuration data, and network intelligence can provide attackers with a valuable roadmap for future operations. Even when no immediate compromise occurs, aggregated infrastructure data can help threat actors identify potential targets, map internet-facing assets, and prioritize organizations for follow-on attacks. The incident highlights the importance of minimizing exposed management interfaces, continuously monitoring external attack surfaces, and treating infrastructure metadata as sensitive information that can be weaponized when it falls into the wrong hands.

Yagub Rahimov, CEO, Polygraf AI

“One major insight here in this incident is that complex passwords didn’t help. Passwords of 25+ characters with symbols and numbers was shown in plaintext. Such complex password that’s passed through an infostealer protects you as much as “password123.” Many practitioners, up until now, were treating the credential strength as something that stands between an attacker and the network. The FortiBleed example just proved we can’t deny it. We need to care as much about exposure as we do about the credential strength.

We’ve always had industry standards (rotating credentials, enforcing MFA, etc), but remediation advice fails because nobody finishes it. The problem is that organizations treat a breach as an event to clean up after, not a condition to design around. Because of that, credentials get rotated once, and then everything drifts back. FortiBleed is what that drift looks like when it adds up across an entire vendor’s install base. That incident showed us again that the cleanup mindset is the vulnerability As long as a leak is treated as a discrete incident with a start and an end, the credentials that slip through become the seed of the next dataset. The only thing that changes the outcome is assuming that exposure is continuous, not occasional. Most organizations still aren’t there, which is exactly why there will be another FortiBleed.”

Now is a good time to look at various passwordless options and rotating credentials for example. At least it will limit your exposure to FortiBleed.

The FortiBleed (check out this or this if you want to catch up) exposure is being covered as a patching failure. It’s actually something harder to fix. Data exfiltrated today can sit dormant until quantum computing makes it decryptable. The credentials leaked right now have a shelf life no one can calculate.

Justin Beals, CEO & Founder, Strike Graph, an AI-native GRC and compliance automation platform had this to say:

“Fortinet moved to disclose once the data surfaced. That’s the right call. But the exposure itself points to a problem that’s only going to get worse. Cloud computing at scale has already made mass credential harvesting faster and cheaper than most organizations’ patching cycles can absorb. Quantum computing will make it catastrophic. Data exfiltrated today can sit dormant and be decrypted later, once the compute power to crack it exists. That’s not a hypothetical. It’s a timeline. Every set of credentials leaked right now has a shelf life organizations can’t calculate. What this pushes on, hard, is the need for consistent, continuous updates to credentialing. Not annual reviews, not quarterly rotations tied to audit cycles. The threat is operating on machine time. Credential governance has to keep pace with it.”

The question is, will we move to a place where we find out about these sorts of threats BEFORE they become threats? And BEFORE they become quantum computing threats. That’s the real question.