FortiBleed Campaign: A Wake-Up Call for Credential Security
In June 2026, the 'FortiBleed' campaign was uncovered, revealing that cybercriminals had compromised approximately 73,932 Fortinet FortiGate firewalls across 194 countries. The attackers, identified as Russian-speaking, executed over 1.1 billion credential attempts against FortiGate VPN instances and 2.1 billion against Microsoft SQL Server systems. They exploited weak or default credentials and intercepted SSL VPN authentication hashes, which were cracked using a 45-GPU cluster managed through Hashtopolis. This led to unauthorized access to internal Active Directory environments, affecting sectors such as government, telecommunications, financial services, healthcare, manufacturing, and critical infrastructure. Notably, a Turkish NATO defense contractor reportedly lost classified documents due to this breach. This incident underscores the critical importance of robust credential management and the implementation of multi-factor authentication (MFA). The scale and sophistication of the FortiBleed campaign highlight the evolving tactics of threat actors and the necessity for organizations to proactively secure their network devices and monitor for unauthorized access.
Kill Chain
