Threat ActorPublished 23 Jun 2026

Russian Initial Access Broker Behind FortiBleed Campaign

Source SecurityWeek

Description

Using a custom sniffer, the threat actor has captured over 110 million credentials since at least February 2026. The post Russian Initial Access Broker Behind FortiBleed Campaign appeared first on SecurityWeek .

Impact

The campaign compromises network edge firewalls, exposing entire organizational identity layers and enabling lateral movement within networks. Over 110 million credentials have been captured and cracked, leading to unauthorized access to Active Directory domains, network shares, and persistent footholds in victim environments. The operation affects a large number of FortiGate firewalls worldwide, including those managed by MSPs, increasing the risk to supply chains. The compromise of a NATO-aligned defense contractor indicates potential national security implications. The campaign targets multiple sectors and regions, with notable focus on the United States and India.

Defensive guidance

Organizations should monitor for unusual SSH login attempts and unauthorized use of FortiOS diagnostic commands. Given the lack of official vendor guidance in the source data, it is recommended to follow Fortinet's official communications and security advisories for updates. Network defenders should consider restricting SSH access to FortiGate devices, implementing multi-factor authentication where possible, and reviewing firewall logs for signs of compromise related to this campaign.

References

securityweek.com/russian-initial-access-broker-behind-fortibleed-campaign/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 23 Jun 2026, 10:39 UTC

References

Community reviews