FortiBleed Campaign Exploits Fortinet Devices for Ransomware

The 'FortiBleed' campaign represents a massive, structured initial access brokerage operation targeting over 430,000 Fortinet firewall and VPN appliances worldwide. Attackers exploit CVE-2026-35616 (CVSS 9.1), an improper access control vulnerability in FortiClient EMS, to gain administrative control and deploy persistent malware. A Russian-speaking operator, known as 'TOXMAN', has been linked to this infrastructure, serving as a primary provider for the INC Ransom and Lynx ransomware groups.

Technical analysis reveals a sophisticated multi-stage attack chain. Initial compromise is often followed by the deployment of EKZ Stealer, an infostealer obfuscated with control-flow flattening to hinder analysis, and 'FortigateSniffer', a custom Golang tool that intercepts authentication traffic across 24 protocols. The campaign has successfully compromised hundreds of organizations, particularly within the manufacturing and technology sectors across LATAM and APAC.

This threat is of critical urgency due to its direct feed into ransomware-as-a-service (RaaS) operations. With millions of credentials harvested and active exploitation confirmed by CISA's KEV catalog, organizations utilizing Fortinet infrastructure must prioritize patching, credential rotation, and proactive hunting for established indicators of compromise.