The FortiBleed campaign is a credential-harvesting operation led by a Russian-speaking initial access broker targeting FortiGate firewalls and other vendors' devices. The attacker uses tools like Masscan and Shodan to identify vulnerable devices, then performs SSH brute-force attacks to deploy a custom Golang sniffer (FortigateSniffer) that captures authentication traffic across 24 protocols. The captured credentials and password hashes are cracked offline and used for lateral movement and persistent access within compromised environments. The campaign has compromised over 110 million credentials since February 2026, affecting more than 430,000 FortiGate firewalls globally. The operation targets SMBs and supply chains, including MSPs, and has resulted in the exfiltration of sensitive data from high-profile targets such as a NATO-aligned defense contractor. The campaign is financially motivated and may have ties to Russian state-sponsored groups or ransomware gangs. No vendor advisory or patch information is available in the provided data.

The campaign compromises network edge firewalls, exposing entire organizational identity layers and enabling lateral movement within networks. Over 110 million credentials have been captured and cracked, leading to unauthorized access to Active Directory domains, network shares, and persistent footholds in victim environments. The operation affects a large number of FortiGate firewalls worldwide, including those managed by MSPs, increasing the risk to supply chains. The compromise of a NATO-aligned defense contractor indicates potential national security implications. The campaign targets multiple sectors and regions, with notable focus on the United States and India.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should monitor for unusual SSH login attempts and unauthorized use of FortiOS diagnostic commands. Given the lack of official vendor guidance in the source data, it is recommended to follow Fortinet's official communications and security advisories for updates. Network defenders should consider restricting SSH access to FortiGate devices, implementing multi-factor authentication where possible, and reviewing firewall logs for signs of compromise related to this campaign.