FortiBleed: Why This Massive Fortinet Credential Leak Is Far More Dangerous Than It Appears

A dataset containing verified administrative and SSL VPN credentials for more than 73,000 internet-facing Fortinet FortiGate firewalls across 194 countries has been leaked and circulated in criminal underground forums — and security experts say the damage runs far deeper than a routine breach.

The campaign, now formally dubbed "FortiBleed," has emerged as one of the most significant cybersecurity events of 2026. What initially appeared to be a standard credential-stuffing operation has revealed itself to be a sophisticated, automated offensive built on legacy cryptographic weaknesses, industrial-scale cracking infrastructure, and a self-sustaining data harvesting loop. For any organization running internet-facing Fortinet infrastructure, the message from researchers is unambiguous: treat your perimeter credentials as already compromised.

---

How FortiBleed Was Actually Executed

Technical analyses from Fortinet, SOCRadar, CloudSEK, Palo Alto Networks (Unit 42), and Prodaft have pieced together the mechanics of the campaign — and the picture is sobering.

According to threat intelligence findings, a Russian-speaking threat group executed a multi-layered operation at a scale rarely seen in credential-based attacks. The actors launched roughly 1.16 billion credential attempts targeting over 320,000 FortiGate systems. Concurrently, they ran over 2 billion attempts against Microsoft SQL Server (MSSQL) environments.

The Cryptographic Weakness at the Core

But raw volume alone does not explain FortiBleed's success. The attackers exploited a specific backward-compatible behavior buried inside FortiOS credential management. When older versions of FortiOS are upgraded to newer releases, administrative passwords often remain stored as weaker legacy SHA-256 hashes — until an administrator manually logs back in and triggers a migration to the more robust PBKDF2 hashing standard. Millions of devices were silently sitting on this weaker cryptographic foundation without their operators knowing.

This is not a edge-case configuration error. It is a silent, systemic condition affecting any FortiGate device that has been upgraded without a subsequent active administrator login — a step that is easy to overlook and rarely documented in standard upgrade checklists.

Rather than brute-forcing live systems and triggering modern endpoint alerts, the attackers exported configuration files and intercepted SSL VPN authentication hashes — then moved the heavy computational work entirely offline. Operating a massive 45-GPU cracking cluster managed through Hashtopolis, they systematically broke these weak legacy hashes at scale without generating a single alert on live production networks.

This offline methodology is significant. It means organizations cannot rely on perimeter intrusion detection systems or failed-login alerts to signal that their credentials are under attack. By the time a hash is cracked and credentials are used, the attacker arrives with a valid key — not a lockpick.

Fortinet addressed the incident directly, stating: "This is not a new Fortinet vulnerability and this activity is not related to any recent incident or advisory. Upon identifying the incident, we immediately began an investigation including collaborating with relevant government agencies."

The Scale of Exposure Across 194 Countries

The geographic breadth of the leaked dataset — spanning 194 countries — underscores that this is not a targeted campaign against a specific industry or region. Critical infrastructure operators, financial institutions, healthcare networks, defense contractors, and mid-market enterprises are all represented in the compromised data. Organizations that assumed obscurity or sector-specific protections offered any meaningful insulation should reconsider that assumption immediately.

Understanding how sensitive data exposure occurs and escalates through network infrastructure is essential context for evaluating the true downstream risk of this campaign.

---

Why This Goes Far Beyond a Simple Credentials Leak

What separates FortiBleed from a localized security incident is what the attackers did once they had working credentials — and they did not immediately detonate ransomware.

As detailed by Prodaft and corroborated by open-directory infrastructure captured by CloudSEK, verified credentials were used to silently transform compromised firewalls into traffic collection sites. The devices were used to sniff passing corporate traffic, harvest additional downstream credentials, and build highly detailed maps of internal Active Directory environments.

A Self-Sustaining Intelligence Operation

Because the attackers logged in with valid high-level administrative credentials, standard internal behavioral alerts rarely triggered. They essentially became insiders — using legitimate network commands to move laterally and exfiltrate sensitive documents. Among the confirmed stolen material were classified technical blueprints taken from a targeted NATO defense contractor.

SOCRadar described the operation's architecture in a published analysis: "The FortiBleed operation is built around full automation. Stage one is credential reuse: attackers tested usernames and passwords from earlier Fortinet-related breach dumps against internet-facing FortiGate devices around the clock. Stage two is passive harvesting: once inside a device it is used as a listening post — SSL VPN traffic passing through is monitored and additional credentials are collected. Those credentials feed back into the scanner compounding the breach. The system is entirely self-sustaining."

CloudSEK's executive summary reinforced the point: "The toolchain works end to end — scanning located exposed FortiGate interfaces, hashes were cracked on a ~45-GPU Hashtopolis cluster and validated credentials were used to pivot into networks and enumerate Active Directory — all feeding a revenue-sorted catalogue built to sell access."

Why Patching Alone Is Not Enough

Fortinet reinforced a critical point that distinguishes this event from a standard patch cycle: upgrading the OS code alone is insufficient if legacy administrative credentials are not dynamically forced to re-encrypt. The cryptographic vulnerability persists until an administrator actively logs in post-upgrade to trigger the hash migration.

This is an operational gap, not a technical one. The fix exists. The mechanism is in place. But it requires a deliberate human action that standard upgrade procedures do not enforce — and that gap is precisely what FortiBleed exploited at industrial scale.

For organizations assessing their broader exposure, a structured review of enterprise cyber risk across network perimeter devices should be treated as an immediate priority, not a scheduled quarterly task.

---

What Security Teams Must Do Right Now

Fortinet has published a hardening playbook and security teams should treat execution as urgent rather than routine.

Immediate Credential and Access Controls

The immediate priority is a comprehensive credential rotation — forcing resets across all local administrator accounts, user profiles, and SSL VPN credentials across the entire device fleet. Upgrading to FortiOS versions 7.2.11, 7.4.8, 7.6.1 or later must be paired with an active administrative login to complete the credential migration. Organizations should also explicitly enable the login-lockout-upon-weaker-encryption configuration setting to block legacy hash exploitation going forward.

Management interfaces must be removed entirely from the public-facing internet and restricted to dedicated out-of-band networks or limited internal IP zones. Multi-factor authentication with number matching should be mandated across all administrative and remote access pathways — researchers identify MFA as the single most effective control against stolen plaintext credentials.

Forensic Investigation Steps

Critically, because the offline cracking methodology means local firewalls will show no historical brute-force activity, a clean log should not be interpreted as a clean network. Security teams should audit internal environments for:

• Unexpected lateral movement patterns
• Unauthorized Active Directory modifications
• Unusual outbound traffic originating from edge devices
• Unrecognized accounts added to the device — Fortinet specifically flags account names such as "forticloud," "fortiuser," "fortinet-support," and "fortinet-tech-support" as indicators of unauthorized access

The absence of brute-force logs is no longer a reliable indicator of safety when attackers have shifted cracking operations entirely offline. If your organization has not conducted a thorough post-incident forensic review, the working assumption should be that access has occurred.

Rethinking Perimeter Security Architecture

FortiBleed is a reminder that the perimeter is not a static line but a dynamic attack surface. The campaign exposes a broader architectural reality: organizations that treat firewall management as a set-and-forget discipline are operating with unquantified risk at the edge of their networks.

Implementing proactive measures to prevent a data breach through layered perimeter controls has never been more operationally relevant. The lesson from FortiBleed is not simply that Fortinet devices need patching — it is that cryptographic hygiene, management interface discipline, and post-upgrade validation must become embedded operational habits rather than reactive responses to individual incidents.

Three enduring principles emerge from this campaign for security and risk professionals:

• Cryptographic hygiene following device upgrades must be validated actively, not assumed complete based on a successful OS installation
• Management interface exposure to the public internet remains one of the highest-risk configurations an organization can maintain — and one of the most straightforward to remediate
• The absence of brute-force logs is no longer a reliable safety signal when adversaries have industrialized offline credential cracking at this scale