Executive Summary
A global credential-compromise campaign dubbed 'FortiBleed' has exposed verified administrative and VPN credentials for approximately 75,000 Fortinet devices, representing roughly half of the internet-facing fleet. Attributed to a Russian-speaking multi-operator threat group, the campaign utilizes a self-feeding automated pipeline of mass scanning, credential stuffing, and password spraying. The leaked dataset includes high-profile targets across telecommunications, government, financial services, and critical infrastructure sectors.
Technically, the campaign exploits a configuration-hygiene gap where administrator credentials remain stored in crackable SHA-256 format even after firmware upgrades to versions supporting PBKDF2, provided the administrator hasn't re-authenticated to trigger a re-hash. Attackers have successfully cracked complex passwords using a 45-GPU Hashtopolis cluster and have used compromised appliances as 'listening posts' to intercept further authentication traffic. Business impact is severe, with confirmed full network compromises and document exfiltration from defense contractors and government entities.
Key Details
Threat Name
FortiBleed
Affects
FortiCloud SSO
Adversary
Russian-speaking multi-operator threat group Other Adversaries and Aliases: Russian-speaking threat actors; Belsen Group; The Gentlemen Ransomware Group
MITRE Techniques
Malware/Tools
Hashtopolis, FortiBleed, Phantom Stealer, Brickstorm, INC Ransomware, Formbook, LummaC2 Stealer, Luca Stealer, Aurora Stealer