FortiBleed: 73,932 Fortinet Firewall Passwords Leaked Across 194 Countries

The FortiBleed campaign executed in three mechanically distinct phases that threat intelligence researchers at Hudson Rock and Arctic Wolf reconstructed from the attacker's exposed toolchain.

Phase one: reconnaissance. The group used automated scanners to sweep 59.3 million internet hosts for exposed Fortinet management interfaces, FortiGate SSL VPN login portals, and Microsoft SQL Server instances. They fingerprinted approximately 437,000 FortiGate devices during this phase, cataloging active endpoints and software versions for targeted exploitation.

Phase two: credential stuffing. The attackers tested Fortinet-specific credential pairs from historical infostealer malware dumps against every identified login portal, executing approximately 1.16 billion credential attempts. Diachenko's review of the attacker's exposed directory structure revealed curated Fortinet-specific credential lists: cross-referenced infostealer data specifically tagged to Fortinet devices, not generic password lists. The group targeted passwords that had already worked on Fortinet devices before, extracted from stealer logs sold on criminal markets.

Phase three: offline hash cracking. For SSL VPN sessions where credential stuffing failed, the attackers intercepted SSL VPN authentication handshake hashes and loaded them into a 45-GPU Hashtopolis cluster for offline cracking. Hashtopolis is an open-source distributed hash cracking framework widely used in penetration testing and cybercriminal operations. The GPU cluster recovered "long, complex passwords" that would resist standard online brute-force: a capability associated with well-resourced criminal organizations or state-affiliated actors.

Post-access, the threat group documented lateral movement into internal Active Directory environments from compromised FortiGate endpoints, confirming that FortiBleed represents active intrusions, not just a speculative credential inventory.

Attribution remains incomplete, but threat intelligence analysts at SOCRadar, Hudson Rock, and Arctic Wolf have assembled a profile of the FortiBleed operators from the exposed toolchain and dataset organization.

The group is described as a Russian-speaking multi-operator cybercriminal syndicate: multiple individuals or subgroups operating under a shared infrastructure rather than a single actor. The multi-operator model is consistent with initial access broker (IAB) collectives that specialize in large-scale credential harvesting and sell verified access to ransomware affiliates and espionage-motivated actors at prices ranging from a few thousand to tens of thousands of dollars per target depending on the victim's revenue and sector.

The dataset organization is the most telling behavioral indicator. The attackers sorted their 73,932-entry credential inventory by company name, industry sector, annual revenue, and employee headcount. This metadata-enriched sorting is a signature of eCrime operators who package access for buyers filtering targets by deal size. Hudson Rock analysts noted that the FortiBleed database is formatted specifically for buyers who want to filter targets by industry and deal size: consistent with the IAB market model where network access sells per-target.

No ransomware group has publicly claimed credit for the campaign. No ransom demands have been issued to confirmed victims as of June 18, 2026. The absence of immediate extortion, combined with the structured dataset organization and multi-operator profile, points toward a preparation phase: the group is either building an access inventory to sell or preparing to deploy ransomware affiliates across selected high-value targets once the acquisition phase completes.

The FortiBleed Fortinet VPN credential leak spans 194 countries and 21,632 unique domains, encompassing some of the world's largest enterprises, critical infrastructure operators, and government agencies.

Confirmed entries identified by Hudson Rock and independent researchers include: Chevron (energy), Samsung (electronics), Foxconn (manufacturing), Comcast and AT&T (telecommunications), Mercedes-Benz and Toyota (automotive), Siemens (industrial technology), Lenovo (hardware), PwC and Accenture (professional services), Oracle (enterprise software), and multiple unnamed government agencies and critical infrastructure operators.

Geographic concentration is highest in India, the United States, Taiwan, Mexico, Turkey, Thailand, Colombia, Malaysia, Chile, and the United Arab Emirates. The United States representation includes Fortune 500 enterprises, federal contractors, and mid-market organizations across all major sectors.

By industry: telecommunications records the highest volume, followed by IT services, financial services, government and critical infrastructure, healthcare, education, and manufacturing. This distribution reflects FortiGate's dominant market position as an enterprise perimeter firewall: any large organization relying on Fortinet for edge security is a plausible dataset entry.

The 50% internet-facing saturation figure, sourced from Shodan data by Kevin Beaumont, is the operational insight most relevant for defenders. If your organization operates FortiGate firewalls with management interfaces or SSL VPN portals accessible from the internet and has not rotated credentials in the last 90 days, the likelihood of appearing in the FortiBleed dataset is significant. The Fortinet FortiSandbox exploitation campaign documented in the CVE-2026-39813 active exploitation analysis shows that attackers consistently prioritize Fortinet infrastructure as an entry point because controlling the security appliance controls the entire defensive perimeter.

The FortiBleed campaign's IOC profile differs from most credential theft operations. Diachenko discovered the dataset on a misconfigured attacker-controlled server rather than from a dark web forum post, so the exposed infrastructure provides behavioral indicators rather than traditional network IOCs.

No threat actor C2 domains, payload hashes, or specific attacker IP addresses have been publicly attributed to the FortiBleed campaign as of June 18, 2026. SOCRadar's dark web monitoring is actively tracking for distribution of the dataset on criminal forums. Defenders should focus on three categories of behavioral indicators to detect post-exploitation activity.

Credential-stuffing signatures in FortiGate logs: Review VPN authentication logs for login attempts from unexpected source IP ranges, failed authentication spikes against admin or SSL VPN accounts, and successful logins from IP addresses outside your organization's known user locations. The FortiBleed operators used geographically distributed scan infrastructure, making geographic blocking alone insufficient for detection. Arctic Wolf's analysis of the campaign recommends reviewing FortiGate authentication logs from at least January 2026 onward for anomalous patterns (see Arctic Wolf: Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries).

Hash interception artifacts: SSL VPN authentication handshake interception produces RADIUS or LDAP log entries consistent with incomplete authentication attempts followed by no further legitimate session activity. FortiGate logs showing authentication challenges that were never completed in the normal session flow may correspond to hash interception events in the FortiBleed timeline.

Active Directory lateral movement from firewall IPs: The operators documented AD access following FortiGate compromise. Check Windows Security Event logs for Kerberos TGT requests originating from FortiGate management IP ranges, unexpected LDAP queries from firewall service accounts, and Group Policy Object modifications in the hours following any identified credential anomaly on FortiGate devices.

The fastest verification step for any organization operating Fortinet equipment is the Hudson Rock FortiBleed exposure checker at https://www.hudsonrock.com/fortinet. Enter your organization's domain; the tool queries the FortiBleed dataset and returns whether matching credentials appear. This check is free, requires no account creation, and returns results immediately.

Beyond the lookup tool, the credential exposure scope extends to subsidiary and acquired company domains. Organizations with recent M&A activity should check every domain in their portfolio: attackers who inventory by revenue specifically target subsidiary networks that may operate inherited Fortinet deployments without the same credential hygiene controls as the parent organization.

Fortinet has not released a dedicated advisory for FortiBleed because the dataset derives from prior incidents and brute-force attacks rather than a new product vulnerability. The absence of a CVE does not reduce the urgency: credentials valid at the time of the FortiBleed scan remain valid today for any account that has not been rotated. This is precisely the credential exposure dynamic documented in the 16 billion credential dark web leak analysis: infostealer-sourced passwords persist as active risks indefinitely until organizations actively rotate them.

Security teams that confirm their domain appears in the FortiBleed dataset should escalate to a formal incident response engagement rather than treating this as routine credential rotation. Post-compromise Active Directory access documented in FortiBleed analysis means affected organizations may already have unauthorized persistence established in their environments that survives a password rotation alone.

The FortiBleed dataset creates a structural threat that extends beyond the specific organizations named in the exposed records. Fortinet's market position as the most widely deployed enterprise firewall platform makes any mass credential exposure disproportionately dangerous: a single credential from this dataset used successfully gives an attacker administrative control over the network perimeter itself.

Network perimeter control enables everything downstream: disabling security controls, intercepting traffic, establishing persistence across internal systems, and staging ransomware deployments without triggering endpoint detection tools that cannot inspect traffic before it crosses the firewall. Ransomware groups consistently rank initial access through VPN credentials as one of their most frequently exploited entry vectors. A FortiGate admin credential is worth more to an attacker than a compromised workstation because it controls the boundary that all other defenses depend on.

The dataset organization by revenue and sector creates a prioritized targeting list for ransomware affiliates who purchase initial access from IABs. High-revenue organizations in financial services, telecommunications, and critical infrastructure: sectors prominently represented in the FortiBleed data: face elevated probability of ransomware targeting within weeks of any successful IAB transaction using this dataset.

Organizations that cannot execute full credential rotation today due to operational constraints should at minimum enforce MFA on all Fortinet interfaces within 24 hours. MFA blocks credential-stuffing exploitation even when an account password appears in the FortiBleed dataset, interrupting the attacker's chain at the authentication step before any post-access lateral movement becomes possible.