FortiBleed Exploit Campaign Hits 70,000+ Fortinet Firewalls Worldwide

A large-scale cyber espionage campaign dubbed “FortiBleed” has compromised more than 70,000 Fortinet firewalls and VPN gateways worldwide, exposing enterprise networks across 194 countries.

The activity, first identified by security researcher Volodymyr Diachenko and further analyzed by Hudson Rock and Kevin Beaumont, reveals a coordinated effort targeting internet-exposed FortiGate management interfaces.

The dataset contains 73,932 unique firewall URLs mapped to 21,632 affected domains, representing nearly half of all publicly accessible Fortinet devices, making this one of the most significant perimeter security failures observed in recent years.

FortiBleed Exploit Campaign

Threat actors leveraged automated scanning to identify Fortinet devices with exposed management interfaces, then extracted configuration files.

These files enabled offline credential attacks that bypassed rate-limiting controls typically enforced during live authentication attempts.

Investigators estimate that attackers executed approximately 1.16 billion credential attempts against over 320,000 FortiGate systems, alongside an additional 2.1 billion brute-force attempts targeting Microsoft SQL servers.

The campaign is attributed to a Russian-speaking cybercriminal group operating a distributed infrastructure, including a 45-GPU cracking cluster managed through Hashtopolis to accelerate password recovery.

A key factor enabling the campaign was legacy credential storage mechanisms. Although Fortinet introduced PBKDF2-based hashing in early 2025, many devices continued using older SHA-256 salted hashes because administrators had not re-authenticated after patching.

This left credentials vulnerable to offline brute-force attacks once configuration data was exfiltrated. The attackers also intercepted SSL VPN authentication hashes, further expanding their credential dataset and enabling lateral movement into internal environments.

Post-compromise activity demonstrates a clear focus on enterprise network takeover. Once administrative access was obtained, operators pivoted into Active Directory environments to establish persistence, escalate privileges, and exfiltrate sensitive data.

Confirmed incidents include full network compromises in Japan, Taiwan, Vietnam, Iraq, and Turkey, including a Turkish NATO contractor where classified defense documents were reportedly stolen.

The structured nature of the leaked dataset, categorizing victims by sector, geography, and revenue, suggests the operation is tied to initial access brokers monetizing access on underground markets.

The breach affects a wide range of high-profile organizations, including Foxconn, Samsung, Siemens, Lenovo, PwC, Accenture, Comcast, and Oracle, as well as numerous government and critical infrastructure entities.

Analysis of attacker logs shows systematically recorded successful logins and validated credentials, highlighting the industrialized nature of the campaign.

Notably, even highly complex passwords were compromised, underscoring that password strength alone is ineffective when credentials are exposed in plaintext via infostealers or configuration leaks.

Security experts emphasize that organizations should treat this incident as an active compromise scenario rather than a theoretical risk.

Immediate mitigation steps include removing public access to FortiGate management interfaces, enforcing full credential rotation, and ensuring all passwords are rehashed under PBKDF2 by requiring administrator logins post-update.

Additionally, organizations are advised to assume persistence mechanisms may already be in place, conduct thorough forensic analysis, enforce multi-factor authentication across all access points, and monitor credentials against threat intelligence sources to detect reuse of stolen passwords.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.