FortiBleed Campaign Uses FortigateSniffer to Harvest 110 Million Credentials From Fortinet Firewalls

A large-scale credential harvesting campaign called “FortiBleed” has been uncovered, revealing how threat actors are exploiting Fortinet FortiGate firewalls to capture authentication data on an unprecedented scale.

Research from the SOCRadar Threat Research Unit (STRU) indicates that this operation has already compromised over 110 million credentials by targeting misconfigured or weakly secured devices, turning them into silent surveillance points on networks.

FortigateSniffer to Harvest 110 Million Credentials

This campaign is attributed to a financially motivated Initial Access Broker with indications of Russian origin, including tooling artifacts containing Cyrillic comments.

The investigation began with a single exposed directory discovered by security researcher Volodymyr Diachenko and quickly expanded into a broader infrastructure comprising more than 260 operational servers.

Researchers found that the attackers systematically targeted over 430,000 internet-facing FortiGate firewalls, focusing on environments with weak administrative controls.

At the heart of the operation is a custom tool, developed in Golang and named FortigateSniffer, which abuses the legitimate FortiOS diagnostic command “diagnose sniffer packet.”

This feature, typically used for network troubleshooting, was repurposed in this campaign to capture authentication traffic across 24 different protocols, including widely used mechanisms such as NTLM, Kerberos, and RADIUS. This allowed attackers to passively intercept credentials without triggering conventional detection mechanisms.

The attack chain follows a structured five-stage process. First, attackers conduct reconnaissance using tools like Masscan and Shodan to identify exposed FortiGate devices. Next, they deploy SSH brute force attacks targeting administrative accounts.

Once access is gained, the FortigateSniffer tool is used to harvest credential data directly from network traffic. The captured hashes are then processed using a distributed GPU cracking infrastructure powered by Hashtopolis and Hashcat, often relying on rented compute resources from platforms like vast.ai.

Finally, the cracked credentials and session cookies are utilized for persistent access and lateral movement within the network, including targeted data exfiltration.

STRU documented more than 659 harvesting cycles during the campaign, highlighting its automation and operational sophistication. The attackers also maintained an isolated offensive lab environment, featuring Kali Linux virtual machines and automated tooling frameworks such as CyberStrike to streamline their operations.

An analysis of the infrastructure revealed that it was hosted across Russian and Ukrainian networks, complicating attribution efforts.

The impact of FortiBleed goes beyond credential exposure. Researchers confirmed at least one breach involving a NATO-aligned defense contractor, in which sensitive data was exfiltrated following a credential compromise.

Victim analysis shows that small and medium-sized businesses, particularly in the IT services sector with fewer than 200 employees, were disproportionately affected, likely due to weaker security postures.

Security teams are urged to audit FortiGate configurations, enforce strong authentication controls, turn off unnecessary diagnostic features, and monitor for unusual use of packet-sniffing commands.

The report also provides a comprehensive set of Indicators of Compromise to assist in detection and response efforts, as attackers continue to exploit trusted network appliances to carry out large-scale credential theft.

Ioc

Category	Indicator
Aggregator / C2	85.11.187[.]8
Pentest Lab Host	193.8.187[.]2
Credential Validation	193.8.187[.]42
Sniffer Node	193.8.187[.]26
Sniffer Node	194.113.39[.]71
Sniffer Node	77.91.122[.]13
SHA256 – fg_sniffer_linux_amd64	4d0b62d3162d4be391e3ba1e191dad28e5e5d5b161cfdef60eeb4361a92d8413
SHA256 – fg_sniffer_windows_amd64.exe	80d83eb01f28c87a61b51f1f83805e63a791905f019bd3b87f10a10f66efab1e
SHA256 – mpbrute2.bin	2c98c86e6bd6f46cbd6c89d855541b9da91515b1bb986641a77e31c5c6aa2abb
SHA256 – forticheck	a8b09fd4f7ff2f298b45ca602992f44b3c2ac3746bcdb182c59ab2a20c690954

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.