CampaignPublished 22 Jun 2026

FortiBleed campaign used custom FortiGate sniffer to steal credentials

Source Bleeping Computer

Description

Security firm SOCRadar says the large-scale FortiBleed campaign targeting Fortinet FortiGate devices used custom sniffers to harvest authentication secrets from compromised firewalls and steal credentials. [...]

Impact

The campaign results in the theft of authentication credentials, including cleartext passwords, password hashes, Kerberos tickets, and other authentication artifacts from FortiGate firewalls. This enables attackers to gain unauthorized access to corporate networks and potentially escalate privileges. The widespread targeting of over 430,000 devices increases the risk of large-scale credential compromise and subsequent network intrusions. The use of GPU-accelerated cracking significantly reduces the time needed to recover plaintext passwords from hashes, increasing the threat's effectiveness.

Defensive guidance

Fortinet has indicated this is not a new vulnerability but a campaign exploiting previously compromised credentials. Organizations should review the list of IP addresses targeted by the campaign and investigate whether their FortiGate devices have been compromised. Immediate actions include changing all credentials associated with FortiGate devices, enforcing strong password policies, and implementing multi-factor authentication where possible. Monitoring for unauthorized administrative access attempts and disabling or restricting the use of the diagnose sniffer packet command to trusted administrators can reduce risk. Patch status is not applicable as this is not a newly discovered vulnerability; however, organizations should follow Fortinet advisories for any updates.

References

bleepingcomputer.com/news/security/fortibleed-campaign-used-custom-fortigate-sniffer-to-steal-credentials/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Jun 2026, 20:24 UTC

References

Community reviews