Loading threat actor…
FortiBleed is a large-scale cybercriminal initial access and credential-harvesting operation focused primarily on compromising Fortinet FortiGate firewalls. The campaign has been characterized as a structured access-brokering enterprise that used a Golang-based sniffer on compromised edge devices to steal credentials and facilitate follow-on intrusion activity. Reported post-compromise actions included VPN compromise, access to domain controllers, and takeover of domain administrator privileges, indicating that the operators were capable of moving from perimeter-device compromise into broader enterprise network control. FortiBleed appears to function chiefly as an initial access broker rather than as a dedicated ransomware brand. High-confidence reporting links FortiBleed-derived access to downstream ransomware activity involving the Inc Ransom and Lynx ransomware ecosystems, with evidence suggesting those groups used or acquired access obtained through the FortiBleed operation. Confirmed downstream impacts included ransomware deployment and encryption across victim environments, but the dominant pattern associated with FortiBleed itself is credential theft, victim profiling, access brokering, and enabling later monetization by other actors. The campaign operated at global scale against insecure FortiGate deployments and reportedly also expanded access through exploitation of a zero-day vulnerability affecting Nextcloud. Available reporting describes FortiBleed as an organized team with a small core of operators and broader supporting personnel. Known aliases are limited to FortiBleed.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
14 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.