Executive Summary
In June 2026, the 'FortiBleed' campaign emerged as a significant cybersecurity threat, compromising over 86,000 Fortinet FortiGate firewalls across 194 countries. Attackers utilized a Golang-based tool, FortigateSniffer, to exploit default credentials and weak password practices, turning these devices into passive credential collectors across 24 authentication protocols. This led to the exposure of approximately 110 million credentials, affecting major corporations and government agencies worldwide.
The incident underscores the critical importance of robust password policies and the implementation of multi-factor authentication (MFA). Organizations are urged to review and enhance their security measures to prevent similar breaches, as reliance on default credentials and inadequate password management continue to be exploited by threat actors.
Why This Matters Now
The FortiBleed campaign highlights the ongoing risks associated with default credentials and weak password practices, emphasizing the urgent need for organizations to implement robust authentication measures and regular security audits to prevent such widespread breaches.
Attack Path Analysis
Attackers scanned the internet for exposed FortiGate firewalls, using credential-stuffing and brute-force attacks to gain access. They deployed a Golang-based sniffer tool to capture authentication traffic, extracting credentials across multiple protocols. Utilizing the stolen credentials, they moved laterally within networks, accessing sensitive systems. The attackers established command and control channels to maintain persistent access. They exfiltrated over 110 million credentials, including RADIUS, NTLM, and Kerberos data. The stolen credentials were used for further attacks, including ransomware and data extortion.
Kill Chain Progression
Initial Compromise
Description
Attackers scanned the internet for exposed FortiGate firewalls and used credential-stuffing and brute-force attacks to gain access.
MITRE ATT&CK® Techniques
Valid Accounts
Brute Force
Network Sniffing
Unsecured Credentials
Application Layer Protocol
Remote Services
OS Credential Dumping
Masquerading
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Strong Authentication for Users
Control ID: 8.2.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Identity and Access Management
Control ID: 3.1
NIS2 Directive – Security Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer/Network Security
Critical exposure as FortiGate firewalls compromised in credential harvesting campaign affects security infrastructure, enabling lateral movement and policy enforcement bypass.
Information Technology/IT
Primary target sector for maximizing downstream access through credential stuffing attacks on administrative interfaces, affecting 430,000 FortiGate deployments globally.
Defense/Space
High-value NATO-aligned defense contractors breached via firewall credential harvesting, exposing classified systems to unauthorized access and potential espionage activities.
Financial Services
Banking systems vulnerable through compromised VPN credentials and authentication protocols including RADIUS, NTLM, enabling unauthorized access to sensitive financial data.
Sources
- FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persisthttps://www.darkreading.com/cyberattacks-data-breaches/fortibleed-attackers-firewalls-credentials-stealersVerified
- FortiBleed campaign exposes 75,000 Fortinet firewalls worldwidehttps://www.networkworld.com/article/4186794/fortibleed-campaign-exposes-75000-fortinet-firewalls-worldwide-2.htmlVerified
- FortiBleed: What the Fortinet Firewall Credential Campaign Means for SMBs in Canada and the UShttps://cyberunit.com/insights/fortibleed-fortinet-firewall-vpn-credential-attack/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have significantly limited the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and identity-based access controls.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to exploit exposed firewalls may have been constrained by enforcing strict access controls and continuous verification at every workload boundary.
Control: Zero Trust Segmentation
Mitigation: The deployment of unauthorized tools may have been restricted by enforcing identity-based policies that limit workload interactions.
Control: East-West Traffic Security
Mitigation: The attacker's lateral movement within the network could have been limited by enforcing east-west traffic controls that restrict unauthorized inter-workload communication.
Control: Multicloud Visibility & Control
Mitigation: The establishment of command and control channels may have been detected and disrupted by providing comprehensive visibility and control over multicloud environments.
Control: Egress Security & Policy Enforcement
Mitigation: The exfiltration of sensitive credentials could have been constrained by enforcing strict egress policies that monitor and control outbound data flows.
The scope of subsequent attacks using stolen credentials could have been reduced by limiting the initial data exfiltration and lateral movement within the network.
Impact at a Glance
Affected Business Functions
- Network Security Management
- Remote Access Services
- User Authentication Systems
Estimated downtime: 7 days
Estimated loss: $500,000
Compromised credentials for approximately 75,000 Fortinet firewall devices, including usernames, email addresses, and plaintext passwords.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict lateral movement within the network.
- • Enforce Egress Security & Policy Enforcement to monitor and control outbound traffic.
- • Deploy Inline IPS (Suricata) to detect and prevent intrusion attempts.
- • Utilize Threat Detection & Anomaly Response to identify and respond to suspicious activities.
- • Ensure Encrypted Traffic (HPE) to protect data in transit from interception.
