The FortiBleed campaign involves threat actors deploying a custom tool named "FortigateSniffer" on compromised FortiGate firewalls after gaining administrative access via credential stuffing and brute-force attacks. This tool abuses the legitimate FortiOS diagnose sniffer packet command to capture network traffic containing authentication data across 24 protocols, including RADIUS, NTLM, Kerberos, LDAP, SMTP, and database protocols. Captured data is processed and parsed to extract cleartext credentials and password hashes, which are then cracked using GPU-accelerated Hashcat clusters rented from a third party. The campaign has been active since at least February 2026, targeting over 430,000 devices globally. Fortinet has clarified that this campaign exploits compromised credentials rather than a new vulnerability in FortiGate devices.

The campaign results in the theft of authentication credentials, including cleartext passwords, password hashes, Kerberos tickets, and other authentication artifacts from FortiGate firewalls. This enables attackers to gain unauthorized access to corporate networks and potentially escalate privileges. The widespread targeting of over 430,000 devices increases the risk of large-scale credential compromise and subsequent network intrusions. The use of GPU-accelerated cracking significantly reduces the time needed to recover plaintext passwords from hashes, increasing the threat's effectiveness.

Fortinet has indicated this is not a new vulnerability but a campaign exploiting previously compromised credentials. Organizations should review the list of IP addresses targeted by the campaign and investigate whether their FortiGate devices have been compromised. Immediate actions include changing all credentials associated with FortiGate devices, enforcing strong password policies, and implementing multi-factor authentication where possible. Monitoring for unauthorized administrative access attempts and disabling or restricting the use of the diagnose sniffer packet command to trusted administrators can reduce risk. Patch status is not applicable as this is not a newly discovered vulnerability; however, organizations should follow Fortinet advisories for any updates.