The perimeter firewall has been used as a primary line of defense against external intrusions for years, but the newly uncovered campaign illustrates how these same security appliances can be weaponized against the organizations they are intended to safeguard.
Researchers have discovered a large-scale attack involving a custom Golang-based tool known as FortigateSniffer that has been deployed systematically on compromised FortiGate firewalls since February 2026.
Over 430,000 internet-facing devices have been impacted by the campaign, which is linked to an initial access broker (IAB) believed to be operating as a financial motivation threat actor.
Over 110 million credentials have been collected under covert measures by the attackers.
As trusted network gateways were transformed into silent credential-harvesting platforms, the operation illustrates one of the most significant paradigm shifts in attacker tradecraft, where compromised security infrastructures themselves serve as sources of intelligence and access.
The scale, persistence, and operational sophistication observed throughout the campaign-tracked as FortiBleed-have raised concerns across the cybersecurity community. Particularly after evidence of the exfiltration of sensitive data by a NATO-aligned defense contractor, as well as the potential use of stolen credentials for ransomware, espionage, and post-compromise activities, are emerging.
It is evident from a further analysis of the operation that it extends well beyond credential theft from FortiGate appliances, and demonstrates a highly automated initial-access ecosystem that can be scaled across multiple technological platforms.
CyberStrike, an open-source, artificial intelligence-native offensive security framework, could have been utilized by the threat actors to streamline portions of the attack workflow, emphasizing how automation has become increasingly important in large-scale intrusion campaigns.
As part of the activity, a substantial emphasis was placed on small and medium-sized businesses, especially companies with fewer than 200 employees, with the United States and India emerging as the most heavily targeted regions.
The potential for IT service providers to serve as entry points into broader customer networks likely prompted particular attention for them.
Moreover, researchers observed parallel brute-force attacks on NAS systems, firewalls from Sophos, portals for RDWeb, SSL VPN gateways for Citrix, and Microsoft SQL servers, which suggests that the campaign was designed to acquire access opportunities across diverse enterprise environments.
On May 31 and June 15, 2026 alone, the operators executed at least 659 automated credential-harvesting pipelines, which resulted in the discovery of more than 110 million authentication items.
A total of 14.8 million RADIUS credentials were recovered, along with approximately 924,000 NTLM password hashes, 130,000 Kerberos hashes, and approximately 89 million MySQL authentication tokens, indicating the scale of the operation and the significant downstream risks associated with the reuse and monetization of stolen enterprise credentials.
FortigateSniffer is a purpose-built credential intercept utility that is suited for Linux and Windows environments and was designed to leverage legitimate FortiOS functionality rather than rely on conventional malware.
It has been demonstrated that using FortiGate appliances' native packet diagnostic capabilities, researchers are able to passively monitor authentication traffic moving through compromised devices to collect credentials and authentication artifacts across a wide range of enterprise protocols via the tool.
The captured traffic is then converted into a packet-capture format and processed by a specially designed analysis framework which extracts cleartext usernames, passwords, NTLMv2 hashes, Kerberos tickets, and session cookies in addition to other authentication data.
A structured, multi-stage attack chain is employed in the attack chain, beginning with large-scale internet reconnaissance, which involves the use of scanning utilities and customized filtering tools for the detection and categorization of FortiGate systems by location.
In order to obtain privileged access to administrative interfaces and SSL-VPN services, attackers use credential validation, password spraying, and credential stuffing techniques.
Using persistent SSH access, FortigateSniffer harvests authentication data while recovering hashed passwords are transferred to a dedicated cracking platform using distributed processing and automated task orchestration.
Once successful credentials are recovered, they can be weaponized for lateral movement, Active Directory reconnaissance, Kerberos verification, SMB authentication, and further network expansion, as well as obtaining sensitive information from file shares accessible to the attacker and maintaining authenticated sessions using stolen cookies.
A number of significant operational security measures, such as geofencing controls and time-based execution windows aligned with standard Moscow business hours, were incorporated to reduce detection risk, which appear highly deliberate, with targets prioritized based on perceived economic value before operational resources are committed.
Separate telemetry also revealed an automated validation pipeline that is deployed in recurring five-hour cycles with up to 1,000 simultaneous verification threads, leading to exceptionally high early-stage success rates. Researchers also observed identical usernames and passwords recurring across thousands of different IP addresses, a phenomenon that has raised concerns about the possibility of some credentials being strategically seeded for covert re-entry into compromised environments.
Throughout the course of the investigation, researchers began to gain a deeper understanding of the extent of credential exploitation enabled by the campaign.
Analysis showed that once FortiGate appliances were compromised, attackers deployed FortigateSniffer to covertly collect authentication traffic traversing the devices, allowing them to acquire both cleartext credentials and password hashes that were subsequently cracked, validated, and reused against Active Directory environments, VPN gateways, and other externally accessible enterprise services.
As a result of reviewing intelligence data collected by Hunt Intelligence on June 12, 2026, cybersecurity researcher Volodymyr "Bob" Diachenko identified indicators of this activity, which immediately sparked widespread interest in the operation. Upon examination of the stolen dataset, it was found that credentials were associated with approximately 74,000 firewall URLs covering 194 countries and impacting over 21,000 unique domains.
In response, data from the incident was shared with national computer emergency response teams to facilitate coordination and dedicated exposure-checking portals were launched to assist organizations in determining whether their Fortinet infrastructure had been compromised.
According to researchers, by mid-June, the attackers' database had grown to contain more than 86,000 authenticated and active credentials related to corporate firewalls and VPN services worldwide.
The largest concentration of exposed organizations is found in India and the United States.
These findings are of significance not only due to the high volume of compromised accounts, but also due to their validity; investigators noted that the credentials were systematically tested and verified through an automated validation infrastructure rather than speculative password guessing.
The information gathered from underground marketplaces confirmed suspicions that the campaign is linked to an initial access brokering operation, as the same threat actor previously advertised network access on darknet forums for substantial sums to organizations across a variety of industries, including healthcare, technology, and telecommunications.
Even though it is not yet confirmed that these sales are directly related to the FortiGate harvesting campaign, the overlap indicates that access being collected has potential commercial value. In response, Fortinet has initiated outreach to potentially affected customers and advised organizations to immediately terminate active administrative and VPN sessions, rotate credentials, enforcing multifactor authentication, and reviewing logs and configuration changes in detail. It has also encouraged customers to upgrade FortiOS to the latest versions of FortiOS, which are replacing legacy SHA256-based password storage with Password-Based Key Derivation Function 2 (PBKDF2).
Security teams, however, are cautioned that firmware upgrades alone cannot eliminate this risk, as legacy SHA256 password entries must be manually removed from the system.
After modernization efforts have been completed, attackers may still be able to recover administrative passwords through offline cracking techniques if credentials or configuration files were previously exposed, preserving an opportunity for unauthorized access even after modernization efforts have been completed.
An increasingly common practice in cyber operations is to harvest access information from security infrastructure and gather credential information in large quantities. The FortiBleed campaign highlights this reality.
In addition to the immediate impact on affected organizations, the operation illustrates the capability of combining automated tools, credential validation pipelines, and access brokerage activities in a highly efficient ecosystem to prevent downstream intrusions.
It is important to remind defenders that perimeter devices require the same level of continuous monitoring, credential hygiene, and security review as any other critical asset for a defender.
When organizations rely on internet-facing authentication services, this campaign is an excellent opportunity to reevaluate access control measures, identify security weaknesses, and investigate unauthorized activity proactively before harvested credentials are used to compromise a broader organization.
