FortiBleed campaign compromises 430,000 FortiGate firewalls

A financially motivated hacking campaign has compromised hundreds of thousands of FortiGate firewalls globally, harvesting over 110 million credentials and achieving full network access at some organizations, according to security researchers. The operation, dubbed FortiBleed, has been active since at least February 2026 and represents one of the most extensive credential-harvesting campaigns ever documented targeting network perimeter devices.

The threat actors, assessed to be initial access brokers who sell network access to other criminals, used credential stuffing and brute-force attacks against administrative interfaces to gain initial control of FortiGate devices. Once inside, they deployed a custom tool called FortigateSniffer. This tool, written in the Go programming language with an interface in Russian, abuses a legitimate FortiOS diagnostic command to silently intercept all authentication traffic passing through the compromised firewall. It captures credentials, password hashes, and session cookies from 24 different protocols, including RADIUS, NTLM, Kerberos, LDAP, and SMB.

The operation was highly automated and sophisticated. Researchers from firms including...