FortiBleed is a massive credential theft campaign targeting Fortinet FortiGate firewalls using a custom packet-sniffing tool named 'FortiGate Sniffer' to capture VPN and authentication credentials directly from network traffic. Researchers discovered that the stolen credentials were linked to the INC and Lynx ransomware-as-a-service groups, with evidence showing shared infrastructure and access to ransomware negotiation panels. The campaign targeted over 430,000 FortiGate devices globally, deploying sniffers on approximately 19,000 devices, with around 11,000 still compromised after notifications. The operation includes roughly 500 servers and about 20 members with defined roles. Additionally, the attackers likely exploited a previously unknown Nextcloud zero-day vulnerability to escalate access. Persistent backdoor accounts named 'adminin' were also found on compromised systems. The campaign's scale and ties to ransomware groups highlight a coordinated effort to leverage stolen credentials for ransomware attacks.

The campaign resulted in the theft of credentials from tens of thousands of Fortinet FortiGate devices worldwide, enabling attackers to perform network intrusions and facilitate ransomware operations by INC and Lynx groups. The exposure of VPN and authentication credentials compromises the confidentiality and integrity of affected networks. Persistent backdoors and exploitation of additional vulnerabilities increase the risk of prolonged unauthorized access. The linkage to ransomware groups indicates a high risk of ransomware deployment and associated operational disruption and data loss for victim organizations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should follow Fortinet's official guidance for securing FortiGate devices and monitor for any updates regarding patches or mitigations. Impacted organizations have been notified, and the number of compromised devices has decreased, indicating ongoing remediation efforts. Until official patches or fixes are confirmed, organizations should verify device configurations, remove unauthorized accounts such as 'adminin', and monitor for suspicious activity related to credential theft. Additional mitigation may be required once further technical details and vendor advisories are released.