Introducing FortiBleed!

The SOCRadar Threat Research team just uncovered a staggering, active hacking campaign exposing over 30,000 verified Fortinet firewall credentials.

Here is the damage report:

🌍 Global Reach: 194 countries affected, with the US sitting at the #2 most targeted spot.

🏦 High-Value Targets: The victim roster includes major banks, telecom giants, and government agencies.

🛠️Full Visibility: We tracked the entire operation—the attacker infrastructure, the tools, and the complete victim list.

⚠️ Status: STILL active as of this publication.

Don't wait for an incident to react. Dive into the full discovery, grab the IoCs, and take immediate steps to mitigate the risk and strengthen your posture.

Read the full FortiBleed breakdown here: https://socradar.io/blog/fortibleed-fortinet-firewalls-compromised/

Also check the leak here https://hubs.la/Q04lQnV60

#ThreatIntelligence #Fortinet #CyberSecurity #InfoSec #SOCRadar

Impact

The breach compromises the confidentiality of Fortinet firewall credentials, potentially allowing unauthorized access to critical network infrastructure of affected organizations. This exposure can lead to further network compromise, data exfiltration, and disruption of services for high-value targets including banks, telecoms, and government agencies. The global scale of the breach amplifies its severity and potential impact.

Defensive guidance

Organizations should immediately review the SOCRadar advisory and IoCs provided in the linked blog post to identify potential compromise. Immediate steps include credential rotation for Fortinet firewall accounts, enhanced monitoring for suspicious activity, and applying any official Fortinet patches or mitigations once available. Due to the ongoing nature of the campaign, proactive incident response and threat hunting are recommended.

Summary

FortiBleed is a large-scale breach campaign targeting Fortinet firewall credentials, resulting in the exposure of over 30,000 verified credentials worldwide. The campaign impacts a broad spectrum of high-profile victims such as financial institutions, telecommunications providers, and government entities. The threat actors' infrastructure and tools have been identified and monitored by the SOCRadar Threat Research team. The breach is ongoing, indicating active exploitation and a continuing threat to affected organizations.

Introducing FortiBleed!

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 18 Jun 2026, 07:20 UTC

Technical details

References

Community reviews

Related threats