Forti Bleed Targeted Forti Gate Firewalls in 110 Million-Credential Harvesting Operation
Summary: A Russian-speaking initial access broker is assessed to be behind FortiBleed, a credential-harvesting operation active since February 2026 that has targeted over 430,000 FortiGate firewalls globally, deploying a Golang tool called FortigateSniffer that abuses the FortiOS diagnostic command to passively capture authentication traffic across 24 protocols. Between May 31 and June 15, 2026, the attackers are estimated to have launched at least 659 credential-harvesting pipelines and identified over 110 million credentials, with no new zero-day exploited - Fortinet attributes the intrusions to reused credentials and brute-forcing of weak passwords on devices without MFA.
Bottom line: Over 110 million credentials in roughly two weeks, with a 90% validation success rate in early cycles and a single username-password pair appearing on 3,947 distinct devices, means the perimeter is not being picked - it is being inventoried, and the IT services firms in the target list are the path into their customers.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026