Loading malware…
FortigateSniffer is a custom Golang credential-harvesting tool used in the FortiBleed campaign against compromised Fortinet FortiGate firewalls and SSL VPN infrastructure. Rather than relying on a conventional packet-capture driver, it abuses FortiOS’s native diagnostic packet-sniffing capability to passively monitor traffic traversing the appliance and extract authentication material from multiple enterprise protocols. Reported outputs include cleartext credentials, password hashes, Kerberos-related material, and session data observed in transit, enabling follow-on compromise of internal services and identities.
The tool is associated with a financially motivated initial access broker operation assessed by multiple reports as likely Russian-speaking. After obtaining administrative access to exposed FortiGate devices through credential stuffing, brute-force activity, reused leaked credentials, and related access operations, the operators deploy FortigateSniffer to turn the firewall into a passive collection point at the network boundary. Harvested credentials are then validated, cracked where necessary, and reused for deeper intrusion activity, including access to Active Directory environments, lateral movement, theft of data from internal shares, and handoff or direct use in ransomware intrusions linked in reporting to the INC and Lynx ecosystems.
FortigateSniffer is described as monitoring authentication traffic across 24 protocols and as being compiled for FortiGate-relevant Linux environments, with some reporting also noting a Windows build. Its operational role is best understood as an infostealing network sniffer specialized for credential interception on compromised security appliances. Targeting has been global, with notable emphasis on small and medium-sized organizations and on sectors such as telecommunications, managed service providers, IT services, manufacturing, technology, and logistics, where access to a perimeter device can enable downstream compromise of customer or partner networks.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Однако в мае схема усложнилась, и на устройства начали устанавливать написанный на Go инструмент FortigateSniffer. Этот сниффер злоупотребляет штатной командой FortiOS diagnose sniffer packet, предназначенной для диагностики сети, и пассивно прослушивает проходящий через брандмауэр трафик сразу 24 протоколов.
Однако в мае схема усложнилась, и на устройства начали устанавливать написанный на Go инструмент FortigateSniffer. Этот сниффер злоупотребляет штатной командой FortiOS diagnose sniffer packet, предназначенной для диагностики сети, и пассивно прослушивает проходящий через брандмауэр трафик сразу 24 протоколов.
Однако в мае схема усложнилась, и на устройства начали устанавливать написанный на Go инструмент FortigateSniffer. Этот сниффер злоупотребляет штатной командой FortiOS diagnose sniffer packet, предназначенной для диагностики сети, и пассивно прослушивает проходящий через брандмауэр трафик сразу 24 протоколов.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Однако в мае схема усложнилась, и на устройства начали устанавливать написанный на Go инструмент FortigateSniffer. Этот сниффер злоупотребляет штатной командой FortiOS diagnose sniffer packet, предназначенной для диагностики сети, и пассивно прослушивает проходящий через брандмауэр трафик сразу 24 протоколов.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
STRU tracked scanning activity against roughly 11,250 FortiGate portals in more than 150 countries, with admin-level access confirmed on 409 targets.
STRU tracked scanning activity against roughly 11,250 FortiGate portals in more than 150 countries, with admin-level access confirmed on 409 targets.
STRU tracked scanning activity against roughly 11,250 FortiGate portals in more than 150 countries, with admin-level access confirmed on 409 targets.
Traffic Harvesting: After gaining SSH access, a custom FortiGate sniffer captures sensitive traffic and extracts credentials and authentication hashes.
Once access is obtained, a custom Golang-based credential-harvesting tool dubbed FortigateSniffer is deployed to passively capture credentials from traffic passing through the compromised device.
FortiBleed is a large-scale credential-harvesting campaign that has targeted more than 430,000 FortiGate firewalls worldwide, using a custom tool to passively intercept authentication traffic.
Session Hijacking: Uses session cookies and tokens captured by the sniffer to gain immediate authenticated access to internal applications without additional exploitation
MITRE ATT&CK Techniques ... Credential Access Network Sniffing Adversary-in-the-Middle T1040 T1557 Uses compromised FortiGate to capture login traffic passing through it across multiple services
Сниффер похищает пароли в открытом виде, NTLM- и Kerberos-хеши, тикеты, токены и другие аутентификационные данные.
Once sniffed, the raw SSH terminal output is converted into .pcapng format by the SNIFTRAN engine, then processed through a PCAP Deep Analysis Toolkit (v5.0) that extracts cleartext credentials, NTLMv2 hashes, Kerberos TGS/ASREP tickets, and session cookies.
Once successful credentials are recovered, they can be weaponized for lateral movement, Active Directory reconnaissance, Kerberos verification, SMB authentication, and further network expansion...
Once access is obtained, a custom Golang-based credential-harvesting tool dubbed FortigateSniffer is deployed to passively capture credentials from traffic passing through the compromised device.
A structured, multi-stage attack chain is employed in the attack chain, beginning with large-scale internet reconnaissance, which involves the use of scanning utilities and customized filtering tools for the detection and categorization of FortiGate systems by location.
Once successful credentials are recovered, they can be weaponized for lateral movement, Active Directory reconnaissance, Kerberos verification, SMB authentication, and further network expansion...
Using persistent SSH access, FortigateSniffer harvests authentication data while recovering hashed passwords are transferred to a dedicated cracking platform using distributed processing and automated task orchestration.
On 354 of those, the actor completed the full attack chain: VPN compromise, access to the domain controller, and domain admin.
Analysis showed that once FortiGate appliances were compromised, attackers deployed FortigateSniffer to covertly collect authentication traffic traversing the devices, allowing them to acquire both cleartext credentials and password hashes that were subsequently cracked, validated, and reused against Active Directory environments, VPN gateways, and other externally accessible enterprise services.
Once successful credentials are recovered, they can be weaponized for lateral movement... as well as obtaining sensitive information from file shares accessible to the attacker...
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Golang-based credential-harvesting sniffer deployed via SSH on compromised FortiGate devices. It abuses the FortiOS 'diagnose sniffer packet' command to capture authentication traffic across multiple protocols, enabling credential theft, session hijacking, and follow-on lateral movement.
Go-based sniffer deployed on compromised FortiGate devices to intercept firewall traffic and extract credentials, password hashes, and other sensitive information for follow-on intrusion activity.
A network sniffer deployed on FortiGate firewalls to intercept traffic and harvest cleartext credentials and password hashes for later compromise and persistent access.
A custom Golang credential-sniffing tool used in the FortiBleed campaign to passively intercept FortiGate authentication traffic.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.