FortiBleed: Custom FortigateSniffer Tool Harvests 110 Million Credentials from 430,000 FortiGate Firewalls
A financially motivated threat actor has deployed the custom Golang tool FortigateSniffer across over 430,000 FortiGate firewalls globally, harvesting more than 110 million credentials since February 2026.
A financially motivated threat actor has deployed a custom Golang-based tool called FortigateSniffer across more than 430,000 FortiGate firewalls globally, silently harvesting over 110 million credentials since at least February 2026, including confirmed data exfiltration from a NATO-aligned defense contractor. The campaign, dubbed FortiBleed and investigated by SOCRadar's Threat Research Unit (STRU), represents one of the most extensive credential-harvesting operations targeting network perimeter devices ever documented.
The threat actor, assessed to be an Initial Access Broker (IAB) motivated by financial gain, operated continuously through mid-June 2026, running 659 discrete harvest cycles with infrastructure that remains partially active at the time of writing. Tooling with Cyrillic-alphabet comments suggests a possible Russian origin, with potential links to ransomware groups or state-sponsored actors. CISA has issued an urgent advisory warning organizations to secure their Fortinet devices following reports of a large-scale credential exposure.
The core weapon is FortigateSniffer (also tracked as fg_sniffer), a Golang-based tool compiled for both Linux and Windows. Rather than deploying malware, the tool abuses FortiOS's own built-in diagnostic command diagnose sniffer packet to passively intercept all authentication traffic traversing a compromised firewall across 24 protocols, including RADIUS, NTLM, Kerberos, LDAP, RDP, SMB, MSSQL, FTP, Telnet, and WinRM. Once sniffed, the raw SSH terminal output is converted into .pcapng format by the SNIFTRAN engine, then processed through a PCAP Deep Analysis Toolkit (v5.0) that extracts cleartext credentials, NTLMv2 hashes, Kerberos TGS/ASREP tickets, and session cookies. The tool also incorporates two evasion techniques: GeoIP-based filtering and business-hour scheduling, restricting active sniffing to 07:00–18:00 Moscow Time to minimize anomaly alerts during off-hours.
The operation follows a methodical, five-phase lifecycle. Phase 1 — Reconnaissance & Credential Sourcing: Attackers used Masscan for broad port sweeps, Shodan_Recon for passive enrichment via SSL/certificate metadata, and FortiProbe-fast to classify targets into FortiGate/non-FortiGate/dead. Custom scripts ranked targets by corporate revenue before any exploitation began — reflecting deliberate, economic-value-driven targeting rather than indiscriminate opportunism. Phase 2 — Pairing & Initial Access: The tool gen_rotator generated host-credential Cartesian product combo files. These fed into mpbrute2.bin for SSH brute-force attacks against FortiGate admin accounts using 16 product-specific wordlists, and into forticheck (up to 25,000 threads) for SSLVPN portal credential stuffing.
Phase 3 — Sniffer Deployment & Harvesting: With valid SSH credentials, attackers logged into each compromised FortiGate and injected FortigateSniffer, turning the device into a passive listener. 6,127 devices were loaded in observed deployments, with a 90% SSH validation success rate. By the operation's end, ssh.txt contained 237,330 working FortiGate SSH credentials. Phase 4 — Cracking & Lateral Movement: Harvested hashes were cracked via a Hashtopolis-managed Hashcat GPU cluster augmented by dynamically rented capacity from vast.ai, orchestrated through a dedicated Telegram bot that dynamically allocated one to six GPUs and delivered live cracking telemetry. Lateral movement tools then moved across Active Directory environments. Phase 5 — Exfiltration: backup_dfs.py recursively extracted full DFS shares via SMB and streamed them directly to attacker SSH servers without local staging. On June 15, 2026, following offline cracking of 172 Kerberos RC4 hashes, the actor executed a targeted DFS backup exfiltration against a NATO-aligned defense contractor.
According to SOCRadar's Threat Research Unit, the campaign exposed 23,406 unique domains across 80,553 FortiGate appliances. 66% of victims have fewer than 200 employees, with the 51–200 employee range accounting for 42.3% of all affected domains — organizations large enough to deploy FortiGate but typically lacking dedicated security operations. IT services are the dominant sector (8.4% of victims), a deliberate targeting choice to maximize downstream access into customer environments. India (11.4%) and the United States (10.1%) top the geographic distribution, followed by Taiwan, Mexico, and Turkey. The campaign remains active as of mid-June 2026, with sniffer operations and harvest results directories continuing to be updated. Organizations are urged to audit FortiGate SSH access, rotate all administrative credentials, and monitor for the indicators of compromise published by SOCRadar.
SOCRadar's latest analysis reveals the operation has expanded beyond Fortinet — the threat actor also scans Sophos SSL-VPN and RDWeb portals, and maintains two credential datasets: one aggregating leaks and purchased data across multiple vendors, and another of 16 dictionaries for FortiGate admin accounts. The report ties the actor to a Russian-speaking IAB and notes that a NATO-aligned defense contractor's Kerberos hashes were cracked and exfiltrated on June 15, suggesting possible collaboration with state-sponsored groups or ransomware affiliates.
Dark Reading reports that the threat actors behind this campaign deployed a Golang-based sniffer—distinct from the previously documented FortigateSniffer—to intercept plaintext authentication data from traffic traversing the compromised firewalls, yielding 110 million credentials. The new coverage emphasizes that the attackers have turned the firewalls themselves into credential-stealing infrastructure, enabling persistent credential harvesting at the network edge. No new CVEs or patches are disclosed; the article reinforces the scale and ongoing nature of the FortiBleed campaign.
New analysis from ZenoX and CloudSEK, based on a leak of attacker tools and scripts, reveals the full FortiBleed attack chain: attackers scanned for exposed FortiGate interfaces, used compromised credentials to log in, intercepted live authentication traffic from 24 protocols, and cracked password hashes via rented GPU capacity on Vast.ai controlled through a Telegram bot. The campaign also leveraged the open-source penetration testing AI agent CyberStrike for automated reconnaissance and management panel interaction. Free checkers from SOCRadar and Hudson Rock now allow organizations to query whether their domains appear in the FortiBleed dataset, and Fortinet has issued specific remediation guidance including factory reset of compromised devices and rotation of IPsec VPN keys.
SOCRadar's fresh report reveals that the FortiBleed campaign is part of a broader multi-vendor initial access operation targeting not only FortiGate firewalls but also Synology NAS, Sophos firewalls, RDWeb portals, Citrix SSL-VPNs, and MS-SQL servers since February 28, 2026. The attackers have launched at least 659 credential-harvesting pipelines, yielding over 110 million credentials including 14.8 million RADIUS credentials, 924,000 NTLM hashes, and 89 million MySQL authentication tokens. The operation runs in 300-minute cycles with 1,000 simultaneous threads, achieving a 90% validation rate in early cycles, and uses a geofencing filter that restricts sniffing to specific IP ranges between 7 a.m. and 6 p.m. Moscow Time.
The latest coverage, based on SOCRadar's full analysis, details the five-phase attack chain — from credential sourcing via leaked passwords and internet scanning to data exfiltration through SMB/DFS shares and session cookie replay — and reveals that parts of the workflow are assisted by an AI-powered autonomous penetration testing agent. Researchers also identified a distributed GPU password-cracking cluster orchestrated with Hashtopolis and a custom Telegram bot, underscoring the industrial scale of the operation. Approximately 66% of victims have fewer than 200 employees, and the campaign continues to actively sniff traffic on over 19,000 firewalls.
New analysis reveals that the FortiBleed campaign, which exploited Fortinet devices, is directly linked to the INC and Lynx ransomware operations. Researchers discovered evidence of threat actors accessing ransomware negotiation panels from within the FortiBleed infrastructure, indicating the stolen credentials were intended to fuel future network intrusions. The campaign is now believed to have targeted over 430,000 FortiGate firewalls worldwide, with approximately 19,000 devices deploying traffic sniffers.