Loading story…
A large-scale campaign dubbed FortiBleed harvested credentials from internet-facing Fortinet devices, with researchers reporting stolen data from more than 70,000 to 75,000 devices across up to 194 countries and evidence that more than 430,000 FortiGate firewalls were targeted. SOCRadar said the operators used default or previously leaked credentials to access devices, deployed a custom packet-sniffing implant known as FortiGate Sniffer, captured VPN and other authentication data in real time, and in some cases left persistent backdoor accounts such as adminin. Open-source reporting and government alerts also tied the activity to Fortinet flaws including CVE-2024-55591, CVE-2025-59718, and CVE-2025-59719, while Fortinet disputed claims that the exposed credentials reflected a new product breach and said some data may have come from earlier compromises or brute-force activity.
The stolen access was allegedly linked to the INC and Lynx ransomware ecosystems, with researchers citing exposed infrastructure, ransomware negotiation-panel artifacts, credential-stuffing systems, and cases where intrusions progressed to encryption of hundreds of endpoints. Reports said credentials belonging to UK government officials, Foreign Office staff, embassy personnel, NHS trusts, local councils, energy firms, and pharmaceutical suppliers were offered for sale on dark-web forums, raising concern over follow-on attacks against sensitive networks. National defenders including the UK NCSC and Brazil's CTIR Gov urged organizations using Fortinet firewalls and SSL VPNs to review accounts, remove unauthorized users, terminate sessions, reset passwords, enforce MFA, patch affected systems, and inspect logs for signs of compromise and lateral movement.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
BleepingComputer published SOCRadar STRU's report on July 1, 2026, describing FortiBleed as a large-scale credential theft campaign targeting Fortinet FortiGate devices. The research said an exposed server held stolen credentials from more than 73,000 devices, configuration files, and infrastructure for hash cracking and credential stuffing.
In late June 2026, Bob Diachenko discovered an internet-exposed server containing a database of tens of thousands of FortiGate and Fortinet VPN device URLs, usernames, email addresses, and plaintext passwords. Researchers also described the server as holding internal files, logs, automation scripts, and operational data tied to the campaign.
Researchers assessed that the FortiBleed credential-theft campaign had been active since at least February 2026, using mass internet scanning plus default and previously leaked credentials to access Fortinet devices. Attackers then installed a Go-based sniffer on compromised systems to intercept traffic and harvest credentials.
The UK National Cyber Security Centre confirmed that a brute-force campaign against Fortinet devices was underway and urged organizations to inspect networks, isolate compromised devices, and change passwords immediately. The report said UK authorities had not established direct evidence tying the activity to the Russian state.
Cybersecurity reporting said credentials belonging to UK government officials and Foreign Office staff were exposed and offered for sale on dark web forums as part of FortiBleed. Reported victims also included NHS trusts, energy companies, local councils, and embassy staff, with some Foreign Office access advertised for tens of thousands of pounds.
Researchers linked FortiBleed infrastructure to the INC and Lynx ransomware operations after finding artifacts on a Windows server, including browser sessions showing access to ransomware negotiation panels and chats with victims. They also reported overlap between FortiBleed victims and organizations listed on the INC leak site.
CTIR Gov updated Alert 50/2026 on June 19, 2026, continuing to warn of active exploitation and roughly 75,000 devices with potentially compromised credentials reported in open sources. The update maintained guidance on patching, removing unauthorized accounts, and reviewing indicators of compromise.
On June 15, 2026, Brazil's CTIR Gov published Alert 50/2026 warning of a large-scale FortiBleed campaign affecting internet-exposed Fortinet devices and linking it to CVE-2024-55591, CVE-2025-59718, and CVE-2025-59719. The alert recommended immediate mitigation steps including account review, password resets, MFA, firmware updates, and log analysis.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
cert.gov.py
Open sourcescworld.com
Open sourceitpro.com
Open sourceeuronews.al
Open sourcexakep.ru
Open sourcecyberveille.ch
Open sourcegov.br
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A dataset tied to the **FortiBleed** campaign exposed credentials associated with internet-facing Fortinet and FortiGate devices used for SSL-VPN remote access, affecting organizations in **194 countries**. Researchers reported that the collection grew from roughly **73,000** compromised devices to **86,644** firewalls and VPN gateways, and included VPN URLs, usernames, email addresses, and in many cases **plaintext passwords**. Italian authorities warned that the circulating dataset was specifically linked to exposed SSL-VPN credentials on internet-accessible Fortinet systems. Independent validation found that some leaked credentials were authentic and still worked on exposed devices, including systems running recent **FortiOS** versions. Investigators linked the database to active threat actors conducting large-scale scanning, compromising devices, intercepting traffic, and using stolen access to move into internal networks; some follow-on intrusions reportedly ended with ransomware-style encryption of hundreds of systems. Analysis also indicated that both default or built-in Fortinet accounts and organization-created accounts were present in the leak, pointing to weak credential hygiene and credential reuse as contributing factors, while the original intrusion vector remained unknown.
Aug 1, 2026
A large-scale credential-harvesting campaign has compromised more than **30,000 Fortinet FortiGate firewalls and VPN gateways** across **194 countries**, according to SOCRadar, which said the attackers amassed a database of **30,791 verified working credentials**. Researchers said the operation targeted internet-facing Fortinet management and VPN interfaces using **credential stuffing, password spraying, brute-force attempts, and reused passwords from prior leaks**, and found **no evidence of a Fortinet zero-day or a breach of Fortinet itself**. The attackers allegedly used compromised devices as listening posts to capture additional credentials and feed them into an automated attack chain, broadening access across sectors including **telecommunications, government, healthcare, finance, education, energy, and other critical infrastructure**. Telecom was reported as the most affected sector, while government entities accounted for **591 entries across 111 domains**; **India and the United States** represented nearly one-third of identified compromises. SOCRadar said the campaign remained active and assessed it as **critical**, with tooling and victim selection described as consistent with **Russian-speaking threat actors** and possible motives spanning both **financial gain and cyberespionage**.
Jul 23, 2026
Researchers and national defenders warned that **FortiBleed** has left more than **75,000 Fortinet firewall devices** compromised, exposing organizations worldwide through internet-facing security infrastructure. Hudson Rock first reported tens of thousands of affected Fortinet systems and later raised the estimate above 75,000, describing broad exposure across global enterprises and highlighting the scale of the compromise. CERT Bulgaria subsequently issued a public warning on FortiBleed, reinforcing that the incident affects a massive number of Fortinet firewall devices and poses a serious risk to exposed organizations. The combined reporting indicates a widespread compromise of perimeter security appliances, with impacted enterprises facing potential unauthorized access, data exposure, and downstream intrusion risk through trusted network defenses.
Aug 11, 2026