FortiBleed is an ongoing global campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. It exploits reused or leaked credentials and legacy SHA-256 password storage to harvest and crack authentication data at scale. Attackers gain access by scanning for exposed SSL VPN portals, performing credential stuffing and password spraying, and cracking stolen password hashes offline. Once inside, they create new administrative accounts for persistence and conduct Active Directory enumeration to expand access. Organizations may experience account lockouts due to attacker actions. The campaign acts as an initial-access broker with links to ransomware affiliates INC/Lynx and Payload, representing a significant medium-severity threat requiring immediate defensive measures.
An exposed attacker server has unveiled FortiBleed, a large-scale credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways globally. This operation involved credential harvesting through reuse, brute force, and hash cracking using a distributed GPU infrastructure with approximately 36 rented GPUs via Hashtopolis. The exposed directory contained 319 files revealing scanning tools, cracking infrastructure, credential databases, post-exploitation toolkits, and active VPN configurations. While initially reported as affecting 21,632 domains, analysis of the attacker's own tooling reveals only 918 organizations showed evidence of internal network compromise, with merely 148 confirmed cases where credentials were fully cracked. The operation ultimately aimed to sell initial access to compromised networks, with victims spanning 194 countries, predominantly India, United States, and Taiwan.
