CTIPilot

FortiBleed

incident · incident:fortibleed-fortigate-credential-exposure

Exposure of 73,932 FortiGate device credentials ('FortiBleed') with an active Russian-speaking brute-force and AD-lateral-movement campaign; SOCRadar later tied the infrastructure to INC/Lynx.

Coverage timeline
1
first 2026-06-18 → last 2026-06-18
Peak priority
high
1 high
Sources cited
9
6 hosts
Sections touched
1
active-threats
Co-occurring entities
0
no co-occurrence
ATT&CK techniques
1
pinned v19.2 · see below

Hunting pivots

Tags
actively-exploiteddata-breachidentityrussia-nexus

ATT&CK techniques

1 technique observed across 1 entry, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Privilege Escalation TA0004

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-06-18/fortibleed-73-932-internet-facing-fortigate-devices-exposed · ATT&CK page ↗

Story timeline

  1. 2026-06-18FortiBleed, 73,932 internet-facing FortiGate devices exposed, Russian-speaking group cracking credentials into Active Directory
    active-threats

Where this entity is cited

  • active-threats1

Source distribution

  • bleepingcomputer.com3 (33%)
  • securityweek.com2 (22%)
  • arcticwolf.com1 (11%)
  • cisa.gov1 (11%)
  • fortinet.com1 (11%)
  • socradar.io1 (11%)

explore in graph

All cited sources (9)

Entries about FortiBleed (1)

2026-06-18 · view entry permalink →

HIGHexploitedupdated

FortiBleed, 73,932 internet-facing FortiGate devices exposed, Russian-speaking group cracking credentials into Active Directory

A dataset branded "FortiBleed" surfaced on 2026-06-17 containing 73,932 unique FortiGate management URLs (roughly 75,000 devices across 194 countries and 21,632 domains) paired with valid VPN and administrative credentials (BleepingComputer, 2026-06-17). Fortinet's position is that this is not a new vulnerability: the corpus is a reshare of data from previous incidents combined with large-scale brute-forcing, and the credentials were validated as working. Per BleepingComputer, a Russian-speaking actor is performing systematic credential validation, offline password cracking and onward lateral movement into Active Directory at fully-compromised organisations in several countries (BleepingComputer, 2026-06-17); Arctic Wolf is separately tracking the FortiBleed campaign's reach across 194 countries (Arctic Wolf, 2026-06-17). The technique class is valid-account abuse (T1078) following credential access, not exploitation of a fresh CVE.

Why it matters to us: FortiGate is ubiquitous on Swiss and EU public-sector perimeters. Treat any internet-exposed FortiGate's local admin and VPN credentials as potentially in the corpus regardless of patch level, patching does not rotate an already-leaked credential. Force admin and VPN password resets, enforce MFA on all administrative and VPN logins, restrict the management interface off the WAN, and review FortiGate admin-login audit events and downstream domain-controller authentication (Windows EID 4624/4768) for logins from unexpected source addresses.

Threat actors deployed a Golang-based tool called 'FortigateSniffer' that abused FortiOS's built-in diagnose sniffer packet functionality to harvest authentication credentials from network traffic

BleepingComputer

Fortinet states the attack does not exploit new vulnerabilities, but rather reuses credentials from prior incidents ... combined with brute-force techniques against systems lacking strong passwords and MFA

SecurityWeek
Updaterun 2026-06-20-4cfd00efregionssourcestagsbody

The FortiBleed SSL VPN credential-harvesting campaign has grown from the 73,932 internet-facing FortiGate devices reported on 2026-06-18 to 86,644 confirmed compromised credentials across 194 countries, and CISA has published an emergency hardening advisory (SecurityWeek, 2026-06-19; CISA, 2026-06-18).

The new detail is methodology and impact: a Russian-speaking actor cracked SSL VPN password hashes with a 45-GPU Hashtopolis cluster, after which the actors pivot into internal Active Directory using harvested service and admin accounts (BleepingComputer, 2026-06-19). CISA's guidance mandates immediate SSL VPN session termination, full credential resets, enforcement of PBKDF2 (replacing the older MD5-crypt admin-hash scheme), and phishing-resistant MFA on all remote access. Defenders should cross-reference SSL VPN session logs against the Shadowserver notification feed and hunt for sequential VPN authentication failures from rotating residential IP ranges followed by a success and immediate internal RDP/SMB/LDAP reconnaissance.

Updaterun 2026-06-23-165387f6evidencesectorssourcesbody

New analysis published 2026-06-22 gives the first complete tool-chain picture of the FortiBleed credential-harvesting campaign. The operators deploy a purpose-built Golang tool, FortigateSniffer, that abuses FortiOS's native diagnose sniffer packet diagnostic command to capture authentication traffic on a compromised FortiGate; a second tool, SNIFTRAN, converts the captured traffic to PCAP, which a Python toolkit then parses for cleartext credentials, NTLM hashes, Kerberos tickets and LDAP/SQL auth material across ~24 protocols (BleepingComputer, 2026-06-22; SOCRadar, 2026-06-16).

Fortinet's PSIRT response confirms the campaign uses no new vulnerability, it reuses credentials from the previously-disclosed CVE-2026-24858, CVE-2025-59718 and CVE-2025-59719 plus brute force against devices lacking strong passwords and MFA (Fortinet PSIRT, 2026-06-19; SecurityWeek, 2026-06-22). Reported tradecraft includes a distributed 36-GPU cluster (rented from a generative-AI provider, per BleepingComputer) for offline cracking of the harvested hashes; SOCRadar characterises the operators as Russian-speaking (SOCRadar, 2026-06-16).

The delta for defenders is a concrete detection surface that earlier coverage lacked: FortiOS audit-logs diagnose sniffer packet execution, so hunt for unexpected CLI sniffer invocations and stray PCAP files on the appliance, and (because harvested AD credentials are the downstream prize) treat all domain credentials on any FortiBleed-corpus device as compromised and force a domain-wide rotation, watching for anomalous Kerberos service-ticket requests (event 4769) and new-source Logon Type 3 events (4624) against privileged accounts. Upgrade to firmware with PBKDF2 password hashing to make offline cracking expensive, terminate active sessions, enable MFA and disable external management access.

incident18 Jun 05:10Zmulti-sourceOpen finding ↗
Sources: BleepingComputer · Arctic Wolf · SecurityWeek · CISA alert · Fortinet PSIRT · SOCRadar