FortiBleed is a credential-harvesting campaign targeting FortiGate firewalls, using a network sniffer called FortigateSniffer to extract cleartext credentials and password hashes from network traffic. Since February 2026, it has compromised over 430,000 firewalls and harvested more than 110 million credentials. Attackers gained administrative access on hundreds of FortiGate portals, completing full attack chains including VPN compromise and domain admin privilege escalation. The stolen credentials have been used by ransomware operations INC and Lynx, confirmed by overlapping victim sets and shared operator infrastructure. The campaign is attributed to a Russian initial access broker aiming to establish persistent access and facilitate ransomware deployment. The operation involves roughly 20 individuals with roles ranging from intrusion to technical support.

The campaign has resulted in the compromise of hundreds of thousands of FortiGate firewalls and the theft of over 110 million credentials. Attackers have gained administrative access on hundreds of targets, enabling them to compromise VPNs, access domain controllers, and escalate privileges to domain admins. This has led to ransomware deployment in at least 12 incidents, with hundreds of endpoints encrypted across affected organizations. The direct use of harvested credentials in ransomware attacks by INC and Lynx ransomware groups demonstrates a significant operational impact on victim organizations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations using FortiGate firewalls should monitor vendor advisories for patches or official mitigations related to FortiBleed. Until an official fix is available, restrict administrative access to FortiGate portals, enforce strong authentication methods, and consider network segmentation to limit exposure. Review firewall logs for unusual access patterns and consider rotating credentials and VPN keys if compromise is suspected.