Summary
A large-scale credential compromise campaign dubbed “FortiBleed” has exposed valid VPN and administrator credentials for over 73,000 internet-facing FortiGate firewalls across 194 countries — roughly half of all reachable FortiGate devices worldwide. The leaked dataset, which began circulating in underground forums in mid-June, includes VPN credentials, firewall configurations, usernames, email addresses, plaintext passwords, and Kerberos hashes.
Security researchers at SOCRadar and Arctic Wolf attribute the leak to a combination of historical compromises, previously exploited vulnerabilities, and weak password hashing. Many affected devices still used SHA-256 for credential storage rather than the stronger PBKDF2 algorithm Fortinet introduced in late 2025. Attackers systematically extracted configuration backups and cracked the stored hashes offline. The campaign has been linked to Russian-speaking threat actors.
CISA, Australia’s ASD ACSC, and Singapore’s CSA have all issued advisories urging immediate credential resets, MFA enforcement, restriction of management interfaces from public access, and upgrades to the latest FortiOS versions that enforce PBKDF2 hashing.
Sources
- BitSight — FortiBleed security alert
- Arctic Wolf — Active FortiBleed campaign across 194 countries
- Help Net Security — 74K Fortinet credentials stolen
Commentary
FortiBleed is a painful reminder that credential hygiene at scale remains one of the industry’s most persistent failures. This isn’t a novel zero-day — it’s the result of organizations running outdated firmware, using weak password hashing, and exposing management interfaces to the internet. The fact that ~50% of all internet-reachable FortiGate devices were caught in this campaign should be a wake-up call for every network team running Fortinet infrastructure.
The remediation playbook here is straightforward but labor-intensive: rotate every credential, enforce MFA, upgrade FortiOS, and assume compromise until verified otherwise. For managed service providers, this is an especially brutal one — many of these devices sit at the perimeter of customer networks, and a single compromised firewall can be the initial access vector for ransomware deployment across an entire client base.