🛡️ Threat Intelligence Report: FortiBleed — Massive Fortinet Credential Compromise Campaign

1. Source Reports Table

2. Executive Summary

Overview

On June 17, 2026, security researcher Volodymyr "Bob" Diachenko disclosed the existence of FortiBleed — a massive credential compromise campaign targeting Fortinet FortiGate firewalls and SSL VPN gateways worldwide. The dataset, which surfaced on underground forums and was subsequently confirmed by multiple independent threat intelligence firms, contains valid administrator and SSL VPN credentials for approximately 73,932 unique FortiGate device URLs spanning 194 countries and over 21,600 domains. This represents roughly 50% of all internet-facing FortiGate firewalls globally.

FortiBleed is not a single zero-day vulnerability, but rather the culmination of a long-running, multi-pronged credential-harvesting operation. A Russian-speaking threat group, operating as an Initial Access Broker (IAB) under the alias "SantaAd", executed over 1.16 billion credential attempts against FortiGate devices and 2.1 billion brute-force attempts against Microsoft SQL Server systems. The attackers intercepted SSL VPN authentication hashes and systematically cracked them using a distributed 45-GPU cluster managed via Hashtopolis, yielding plaintext credentials at industrial scale.

The campaign's verified victims include Fortune Global 500 companies, government agencies, defense contractors (including a Turkish NATO defense contractor from which 105 GB of classified military data was exfiltrated), critical infrastructure operators, hospitals, universities, and multinational corporations — including Foxconn, Samsung, Comcast, Siemens, Lenovo, PwC, Accenture, and Oracle.

The exposure window remains ongoing as of June 20, 2026, with new victims continually added to the attacker's validated credential database. Many affected organizations remain unaware of compromise because the credential theft originated from exported configuration files — meaning no login event was logged on the device itself during the initial hash extraction.

Diagram: Attack Flow Overview

┌─────────────────────────────────────────────────────────────────────────────┐
│                     FORTIBLEED CAMPAIGN ATTACK FLOW                         │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  1. RECONNAISSANCE & SCANNING                                               │
│  ┌──────────────────────────────────────────────────────────────────┐       │
│  │ Internet-wide scanning for exposed FortiGate management          │       │
│  │ interfaces and SSL VPN portals (ports 443, 4443, 8443, 10443)    │       │
│  │ Also targeting: Synology NAS, Sophos firewalls, MSSQL servers    │       │
│  └──────────────────────────────┬───────────────────────────────────┘       │
│                                 │                                           │
│  2. CREDENTIAL HARVESTING       ▼                                           │
│  ┌──────────────────────────────────────────────────────────────────┐       │
│  │ ┌────────────────┐  ┌─────────────────┐  ┌───────────────────┐  │       │
│  │ │ Brute-Force    │  │ Configuration   │  │ Infostealer Logs  │  │       │
│  │ │ 1.16B attempts │  │ File Export     │  │ (prior leaks)     │  │       │
│  │ │ against 320K   │  │ via exposed     │  │ + Credential      │  │       │
│  │ │ FortiGate URLs │  │ mgmt interfaces │  │   Stuffing        │  │       │
│  │ └───────┬────────┘  └────────┬────────┘  └────────┬──────────┘  │       │
│  │         │                    │                     │             │       │
│  └─────────┼────────────────────┼─────────────────────┼─────────────┘       │
│            │                    │                     │                      │
│  3. HASH CRACKING              ▼                     │                      │
│  ┌──────────────────────────────────────────────────────────────────┐       │
│  │ Hashtopolis distributed GPU cluster (45 GPUs)                     │       │
│  │ ─ SHA-256 with Salt (legacy FortiOS hashing) → cracked offline   │       │
│  │ ─ SSL VPN authentication hashes → intercepted & cracked          │       │
│  │ ─ Kerberos/NTLM hashes from AD → post-compromise cracking       │       │
│  └──────────────────────────────┬───────────────────────────────────┘       │
│                                 │                                           │
│  4. VALIDATION & ENRICHMENT     ▼                                           │
│  ┌──────────────────────────────────────────────────────────────────┐       │
│  │ ─ Verify every credential before adding to database               │       │
│  │ ─ Enrich with business intelligence (revenue, sector, geography)  │       │
│  │ ─ Filter out honeypots (clean_honeypots.py)                       │       │
│  │ ─ Package validated access for underground market sale            │       │
│  └──────────────────────────────┬───────────────────────────────────┘       │
│                                 │                                           │
│  5. POST-EXPLOITATION           ▼                                           │
│  ┌──────────────────────────────────────────────────────────────────┐       │
│  │ ┌──────────────────┐  ┌───────────────────┐  ┌────────────────┐ │       │
│  │ │ Deploy network   │  │ AD enumeration    │  │ Exfiltration   │ │       │
│  │ │ sniffers on FW   │  │ (ad_enum.py)      │  │ via SMB/DFS    │ │       │
│  │ │ (fg_capture.log) │  │ Password spray    │  │ (105 GB from   │ │       │
│  │ │ → feed creds     │  │ (spray_admin.sh)  │  │  Turkish MoD)  │ │       │
│  │ │   back to system │  │ impacket tools    │  │                │ │       │
│  │ └──────────────────┘  └───────────────────┘  └────────────────┘ │       │
│  └──────────────────────────────────────────────────────────────────┘       │
│                                                                             │
│  6. MONETIZATION                                                            │
│  ┌──────────────────────────────────────────────────────────────────┐       │
│  │ ─ Sale on underground forums (sorted by revenue/sector)           │       │
│  │ ─ IAB marketplace listings ("SantaAd" persona)                    │       │
│  │ ─ Ransomware precursor access                                     │       │
│  │ ─ Espionage-driven selective intrusions                           │       │
│  └──────────────────────────────────────────────────────────────────┘       │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

Attribution & Threat Actor

Primary Attribution: A Russian-speaking, multi-operator cybercriminal group operating as an Initial Access Broker (IAB) under the alias "SantaAd" (per SpyCloud Labs). Key attribution indicators:

• Language: Russian-language comments in code, Russian-language Telegram channels for coordination
• Infrastructure: Multi-server setup with operational separation (brute-force server, operator workstation, Hashtopolis cracking cluster)
• AI-Assisted Tooling: Operators built custom tooling using AI code editors (Cursor) and agentic pentesting frameworks (CyberStrike), enabling rapid scaling
• Operational Maturity: Credential databases enriched with business intelligence (company revenue, industry vertical), honeypot filtering, and systematic victim prioritization
• Targeting Bias: Disproportionate focus on NATO-adjacent states (India, Ukraine, Poland, United States), government sectors, and high-revenue enterprises
• Motive: Primarily financially motivated (IAB operations, credential sales), with a geopolitical element in targeting NATO defense contractors and government agencies

Operational Profile:

Note (CloudSEK Divergence): CloudSEK's analysis provides a notable counterpoint to the headline impact figures. Their investigation of the attacker's open directory revealed that while ~73,932 device entries exist, only 918 organizations showed evidence of internal Kerberos traffic capture, and just 148 had confirmed cracked Active Directory credentials. This suggests the actual number of deep compromises is significantly lower than headline figures, though the credential exposure itself remains critical.

3. Technical Details

3.1 Root Cause: Legacy Password Hashing in FortiOS

The campaign's success is fundamentally enabled by a legacy password hashing weakness in FortiOS. Historically, FortiGate devices stored administrator credentials using SHA-256 with Salt — a mechanism vulnerable to offline GPU-accelerated cracking. While Fortinet introduced PBKDF2-based hashing in newer FortiOS versions (7.2.11, 7.4.8, 7.6.1), a critical gap remains:

Existing administrator credentials are NOT automatically re-hashed upon firmware upgrade. They remain stored as SHA-256 until each administrator actively logs in post-upgrade to trigger credential re-hashing.

This means even organizations running current FortiOS versions may retain crackable legacy hashes in their configuration files. The attackers exploited this gap systematically.

3.2 Attack Infrastructure (per SpyCloud & CloudSEK)

The attacker's operational infrastructure was inadvertently exposed when their backend server was left publicly accessible. This revealed the complete attack pipeline:

Server Architecture:

Tooling Discovered:

3.3 Credential Harvesting Methodology

The attackers employed four parallel credential acquisition techniques:

1. Mass Brute-Force: 1.16 billion credential attempts against 320,777 FortiGate targets using curated wordlists from prior Fortinet leaks and infostealer databases
2. Configuration File Export: Direct extraction of config system admin blocks from exposed management interfaces, yielding SHA-256 hashed credentials for offline cracking
3. SSL VPN Hash Interception: Deploying network sniffers on compromised firewalls to capture authentication hashes from legitimate user sessions in transit
4. Credential Stuffing: Using plaintext credentials from infostealer malware logs (Raccoon, RedLine, Vidar) against Fortinet interfaces

3.4 Post-Exploitation — Case Study: Turkish Defense Contractor

SpyCloud's analysis revealed the most severe confirmed intrusion:

• Attackers used stolen FortiGate session cookies (via OpenConnect) to bypass VPN authentication
• Pivoted into internal Active Directory environment using impacket
• Exfiltrated Group Policy data, live Kerberos tickets, and NTLM hashes
• Accessed file server over SMB using recovered administrator account
• Exfiltrated 105 GB (12,000+ files) of sensitive military data including technical and operational documents related to military systems deployed in Ukraine

3.5 Affected CVEs (Historical, Enabling Access)

While FortiBleed is not a zero-day vulnerability, the campaign was amplified by organizations failing to patch known Fortinet CVEs:

3.6 Victimology & Scale

Top Affected Countries: India, United States, Ukraine, Poland, Turkey, Germany, Italy

Top Affected Sectors: Government, Telecommunications, IT Services, Financial Services, Healthcare, Manufacturing, Education, Defense

Named Victims (per Hudson Rock): Foxconn, Samsung, Comcast, Siemens, Lenovo, PwC, Accenture, Oracle, Chevron, plus multiple government ministries and NATO-affiliated defense contractors.

4. Detection Opportunities

4.1 Immediate Device-Level Checks (HIGHEST PRIORITY)

• Audit administrator accounts: Look for unexpected accounts (especially support, admin2, fortimanager, or any unrecognized names)
• Check password hashing: Verify all admin credentials use PBKDF2 (set password-hash pbkdf2) — if SHA-256 hashes remain, credentials are compromised
• Review firewall policies: Look for wide-open cross-zone traversal rules or recently modified policies
• Inspect SSL VPN sessions: Alert on active sessions from unexpected geographies, especially outside business hours
• Check for network sniffers: Look for unauthorized packet capture configurations on FortiGate interfaces

4.2 Network & Authentication Monitoring

• Monitor authentication logs for anomalous admin login patterns (unusual IPs, times, geographies)
• Alert on mass failed login attempts against FortiGate management interfaces
• Detect unauthorized configuration exports or backup operations
• Monitor for tunneling tool signatures (Chisel, Neo-reGeorg) in network traffic
• Alert on SSH, VNC, or RDP connections from FortiGate device IPs to internal resources

4.3 Active Directory Monitoring

• Monitor for password spraying patterns against domain controllers
• Alert on abnormal Kerberos ticket requests or NTLM authentication from unexpected sources
• Detect impacket tool signatures in network traffic (DCE/RPC patterns)
• Monitor for mass LDAP enumeration queries
• Alert on new service accounts or administrator account creation
• Check for unauthorized Group Policy modifications

4.4 SIEM/XDR Detection Rules

# Detect FortiGate Management Access from Attacker Infrastructure
title: FortiGate Admin Access from Known FortiBleed Infrastructure
status: experimental
description: Detects administrative access to FortiGate devices from IPs associated with FortiBleed campaign
logsource:
  product: fortinet
  service: event
detection:
  selection:
    srcip:
      - '85.11.187.8'
      - '85.11.187.28'
      - '193.8.187.2'
      - '185.229.26.83'
      - '213.169.49.142'
      - '38.117.87.37'
      - '198.53.64.194'
      - '175.155.64.221'
    action: 'login'
  condition: selection
level: critical
tags:
  - attack.initial_access
  - attack.t1078
  - fortibleed

# Detect Mass Authentication Failures Indicative of Brute-Force
title: FortiGate Mass Authentication Failure - Potential FortiBleed
status: experimental
description: Detects brute-force patterns against FortiGate admin/VPN interfaces
logsource:
  product: fortinet
  service: event
detection:
  selection:
    action: 'login'
    status: 'failed'
  condition: selection | count(srcip) by dstip > 100
  timeframe: 1h
level: high
tags:
  - attack.credential_access
  - attack.t1110
  - fortibleed

# Detect Credential Spraying Against Active Directory Post-FortiBleed Compromise
title: Kerberos Password Spray from Network Perimeter Device
status: experimental
description: Detects password spraying from FortiGate/VPN IP ranges targeting AD
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4771
  condition: selection | count(TargetUserName) by IpAddress > 25
  timeframe: 10m
level: high
tags:
  - attack.credential_access
  - attack.t1110.003
  - fortibleed

4.5 FortiOS CLI Verification Commands

# Check for legacy SHA-256 hashes (VULNERABLE)
config system admin
  get | grep -i "password"
end

# Verify PBKDF2 enforcement
config system global
  get | grep "admin-password-hash"
end

# List all admin accounts
diagnose sys admin list

# Check for unauthorized SSL VPN sessions
get vpn ssl monitor

# Review recent configuration changes
execute log filter category event
execute log filter field action "config-change"
execute log display

4.6 Detection Limitations

• No login event logged: Credentials extracted from configuration file exports do not trigger authentication log entries on the device
• Offline cracking invisible: Hash cracking occurs entirely on attacker infrastructure — no network indicator during cracking phase
• Legacy devices may lack logging: Older FortiOS versions may not log administrative actions comprehensively
• Session cookie replay: OpenConnect-based VPN session replay may appear as legitimate reconnection

5. Conclusion

FortiBleed represents one of the most significant perimeter credential compromise operations ever documented. Key takeaways across all 9 analyzed sources:

1. Scale Without Precedent: The campaign compromised credentials for ~50% of all internet-facing FortiGate firewalls globally, affecting 194 countries and sectors ranging from government and defense to healthcare and finance.

2. Not a Zero-Day — Worse: FortiBleed exploits a fundamental architectural weakness (legacy password hashing persisting after firmware upgrades) combined with widespread poor credential hygiene. Patching alone does not remediate the threat — organizations must force credential re-hashing and rotation.

3. IAB-as-a-Service Model: The "SantaAd" threat group demonstrates the maturation of Initial Access Broker operations into fully automated, AI-enhanced enterprises. Their infrastructure reveals complete end-to-end automation from scanning through credential validation to marketplace listing.

4. Confirmed Espionage Impact: The 105 GB military data exfiltration from a Turkish NATO defense contractor elevates FortiBleed beyond financially motivated cybercrime into the geopolitical threat domain.

5. Diverging Impact Assessments: While headline figures cite 73,000+ compromised devices, CloudSEK's forensic analysis of the attacker's database suggests that confirmed deep network compromises (with AD credential recovery) number closer to 148 organizations. However, all sources agree that any organization with credentials in the dataset should assume compromise.

6. Ongoing Campaign: Unlike point-in-time breaches, FortiBleed is a live, evolving operation with new victims added continuously. The credential feed-back loop (compromised firewalls sniffing additional credentials) creates a self-reinforcing cycle of compromise.

Recommended Immediate Actions:

• Rotate ALL FortiGate admin and SSL VPN credentials immediately — regardless of patch status
• Force PBKDF2 re-hashing by requiring all administrators to log in after upgrading to FortiOS 7.2.11+/7.4.8+/7.6.1+
• Enforce MFA on all administrative and VPN interfaces
• Restrict management interface exposure — remove all internet-facing admin panels; use out-of-band management
• Hunt for compromise indicators — unauthorized accounts, sniffers, tunneling tools, AD enumeration evidence
• Check exposure databases — use Hudson Rock's Fortinet Look-Up portal or contact SOCRadar to verify inclusion in the FortiBleed dataset
• Assume compromise if any credential matches exist — initiate full incident response including AD password resets and forensic investigation

6. Indicators of Compromise (IoC List)

6.1 Network Indicators — Attacker Infrastructure

6.2 Tools & Artifacts (File-Based)

6.3 Behavioral Indicators

6.4 Related CVEs

6.5 Underground Market Indicators

7. MITRE ATT&CK Techniques

Report generated 2026-06-20 via TI Mindmap HUB cross-source correlation. All intelligence derived from 9 open-source and vendor publications.