INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

FortiBleed Attackers Exploit Firewalls to Steal Credentials

| 2026-06-23 12:34 MEDIUM LOW DATA BREACH MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
The FortiBleed attack campaign, which began at least in February 2026, is believed to be carried out by Russian threat actors using a sniffer tool dubbed FortigateSniffer that turns compromised FortiGate firewalls into passive credential collectors. The attackers have targeted more than 430,000 FortiGate firewalls globally and have resulted in the breach of high-value targets such as a NATO-aligned defense contractor. Small to medium-sized businesses with fewer than 200 employees, particularly in the US and India, are among the key targets of this campaign. As a result of the attack, attackers have managed to create over 659 credential-harvesting pipelines using FortigateSniffer, resulting in the theft of more than 110 million credentials, including RADIUS, NTLM, and Kerberos material.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Campaign BasedCampaign Based
Target & Sectors
NORTH_AMERICA NORTH_AMERICA defensedefense governmentgovernment
Incident Timeline
‎2026/06/23
Threat actors used FortigateSniffer to compromise hundreds of thousands of FortiGate firewalls, turning them into passive credential stealers.
victims 200 employees
Key targets of the campaign are small to medium-sized businesses (SMBs) with fewer than 200 employees, particularly in the US and India, according to SOCRadar.
infrastructure Fortigate
…Radar have unpacked the attack chain behind the ongoing threat campaign, which they believe is targeting more than 430,000 FortiGate firewalls globally and has resulted in the breach of high-value targets such as a NATO-aligned defense contractor…
…d the global " FortiBleed " credential-harvesting campaign engineered a sniffer tool to compromise hundreds of thousands of FortiGate routers and turn them into passive stealers in a wave of attacks that's now known to be much broader than initiall…
"FortigateSniffer abuses the FortiOS built-in diagnostic command '-diagnose sniffer packet' to passively capture authentication traffic from compromised FortiGate firewalls," SOCRadar researchers wrote.
This is done by scanning the Internet for exposed FortiGate firewalls and other edge services, enriching the data with organization and revenue information, and ranking targets based on potential value.
…via Klue App Compromise Once targets have been identified, attackers use credential-stuffing and brute-force attacks against FortiGate administrative interfaces and SSH services to obtain valid credentials and footholds on Internet-facing devices.
…otate all credentials tied to Fortinet VPN and administrative interfaces; enforce multifactor authentication (MFA); remove FortiGate management interfaces from direct Internet exposure; and review gateway and authentication logs for suspicious ac…
infrastructure 659 harvesting pipelines
FortiBleed Scope and Victimology So far, attackers have managed to create 659 credential-harvesting pipelines using the tool and already have stolen more than 110 million credentials , including RADIUS , NTLM, and Kerberos material, SOCRadar found.
data_breach 110 credentials
FortiBleed Scope and Victimology So far, attackers have managed to create 659 credential-harvesting pipelines using the tool and already have stolen more than 110 million credentials , including RADIUS , NTLM, and Kerberos material, SOCRadar found.
Tactical Metrics
Metrics
victims
200
Employees
Key targets of the campaign are small to medium-sized businesses (SMBs) with fewer than 200 employees, particularly in the US and India, according to SOCRadar.
Metrics
infrastructure
‎Fortigate
Affected Product
…Radar have unpacked the attack chain behind the ongoing threat campaign, which they believe is targeting more than 430,000 FortiGate firewalls globally and has resulted in the breach of high-value targets such as a NATO-aligned defense contractor…
…d the global " FortiBleed " credential-harvesting campaign engineered a sniffer tool to compromise hundreds of thousands of FortiGate routers and turn them into passive stealers in a wave of attacks that's now known to be much broader than initiall…
"FortigateSniffer abuses the FortiOS built-in diagnostic command '-diagnose sniffer packet' to passively capture authentication traffic from compromised FortiGate firewalls," SOCRadar researchers wrote.
This is done by scanning the Internet for exposed FortiGate firewalls and other edge services, enriching the data with organization and revenue information, and ranking targets based on potential value.
…via Klue App Compromise Once targets have been identified, attackers use credential-stuffing and brute-force attacks against FortiGate administrative interfaces and SSH services to obtain valid credentials and footholds on Internet-facing devices.
…otate all credentials tied to Fortinet VPN and administrative interfaces; enforce multifactor authentication (MFA); remove FortiGate management interfaces from direct Internet exposure; and review gateway and authentication logs for suspicious ac…
Metrics
infrastructure
659
Harvesting Pipelines
FortiBleed Scope and Victimology So far, attackers have managed to create 659 credential-harvesting pipelines using the tool and already have stolen more than 110 million credentials , including RADIUS , NTLM, and Kerberos material, SOCRadar found.
Metrics
data_breach
110,000,000
Credentials
FortiBleed Scope and Victimology So far, attackers have managed to create 659 credential-harvesting pipelines using the tool and already have stolen more than 110 million credentials , including RADIUS , NTLM, and Kerberos material, SOCRadar found.
Intelligence Sources
Dark Reading 2026-06-23