FortiBleed: Inside the Massive Cyber Attack That Compromised 86,644 Fortinet Firewalls

TL;DR: In June 2026, a massive credential-theft campaign dubbed FortiBleed compromised login credentials for 86,644 Fortinet FortiGate firewalls and VPN gateways across 194 countries. Orchestrated by a Russian-speaking threat actor, the attack exploited weak password hygiene and legacy credential hashing. CISA issued an emergency advisory. Government agencies, NATO contractors, and telecom providers are among the confirmed victims.

Introduction: The Largest Fortinet Breach in History

On June 13, 2026, security researcher Volodymyr “Bob” Diachenko stumbled onto an exposed threat actor server hosting a growing, validated database of working login credentials for thousands of internet-facing Fortinet firewalls. What he discovered became the opening chapter of the largest Fortinet-related security incident ever recorded — a masterclass in how basic credential hygiene failures enable catastrophic, global-scale compromise.

The campaign, codenamed FortiBleed, has been active since at least February 2026. Confirmed compromised devices stand at 86,644 FortiGate firewalls and SSL VPN gateways spanning 194 countries, including major government entities, NATO-aligned defense contractors, telecom operators, and universities.

How the FortiBleed Cyber Attack Worked

FortiBleed weaponized a combination of credential hashing weaknesses, credential reuse from prior incidents, and aggressive automated brute-force tooling. According to SecurityWeek and Recorded Future, attackers executed approximately 1.16 billion credential attempts against more than 320,000 FortiGate targets, plus 2.1 billion brute-force attempts against over 160,000 MSSQL servers in a parallel campaign.

The Two-Step Automated Attack Loop

1. Credential spraying: Mass-scanning the internet for Fortinet remote login endpoints, then spraying them with curated lists of known leaked credentials from prior breaches.
2. Passive credential harvesting: After gaining access, deploying passive monitoring on network traffic to silently capture additional credentials in transit and feed them back into the attack pool.

Every captured credential was verified against the live device before being added to the database — producing a fully validated, ready-to-monetize access inventory for half of all internet-exposed Fortinet firewalls on earth.

Why So Many Devices Were Vulnerable: The SHA-256 Hashing Gap

Fortinet introduced PBKDF2-based password hashing in FortiOS 7.2.11, 7.4.8, and 7.6.1, replacing the older SHA-256 mechanism. However, as Arctic Wolf documented, upgrading firmware does not automatically re-hash existing credentials. Administrator passwords remain stored as legacy SHA-256 hashes until each admin logs in post-upgrade — leaving them trivially crackable by the GPU cracking infrastructure the threat actor specifically deployed for this campaign.

Compromised Account Breakdown

Account Type	Share of Breached Credentials
Organization-specific accounts	36.7%
Generic admin accounts	35.0%
Built-in Fortinet system accounts	28.3%

Generic and built-in system accounts together represent 63.3% of all breached credentials — devices where default accounts were never renamed and factory credentials were never rotated. As SOCRadar noted, this gave the attacker a highly reliable target list before any brute force was even needed.

CVEs Linked to the FortiBleed Campaign

• CVE-2024-55591 (January 2025): Authentication bypass in FortiOS and FortiProxy, CVSS 9.6, enabling unauthenticated super-admin access. Exploitation began before patching was available; CISA issued an emergency advisory within 24 hours.
• CVE-2026-24858: Authentication bypass affecting FortiAnalyzer, FortiManager, FortiOS, FortiProxy, and FortiWeb when FortiCloud SSO is enabled.
• CVE-2025-59718 / CVE-2025-59719: FortiCloud SSO authentication bypass vulnerabilities tied to improper verification of cryptographic signatures.

Credentials harvested during exploitation of those earlier CVEs — and never rotated afterward — fed directly into the FortiBleed database. This is initial access broker economics at industrial scale.

Real-World Impact: Who Was Hit and How

The breach reached every major vertical. Top impacted sectors are telecom, government, and education. The five most-affected countries by device count are India, the United States, Mexico, Colombia, and Thailand. Hudson Rock confirmed the breach touches thousands of organizations including major government entities and critical infrastructure providers worldwide.

Samsung: Firewall-Layer Access Exposed

Compromised FortiGate credentials tied to Samsung infrastructure were verified as valid by independent researchers, implying threat actors held authenticated access to the firewall layer protecting Samsung internal network segments — a position from which lateral movement into production systems is a single pivot away.

Oracle: VPN Gateway Credentials Breached

Oracle VPN gateway credentials appeared among verified database entries. For an organization handling enterprise database infrastructure, cloud services, and government contracts, authenticated VPN access represents a first-stage foothold with potentially catastrophic downstream reach.

NATO Contractor: Defense Supply Chain at Risk

A NATO-aligned defense contractor was identified among impacted organizations. Legal teams are reviewing whether Fortinet’s failure to automatically re-hash credentials on firmware upgrade constituted a foreseeable design defect — though no public filing had emerged as of late June 2026.

Government Agencies and Critical Infrastructure

Multiple government agencies across the 194 affected countries had credentials confirmed in the database. Compromised perimeter devices can expose citizen data, classified communications infrastructure, and interconnected critical systems including energy, water, and emergency services networks.

The Threat Actor: Initial Access Broker with GPU Infrastructure

The campaign is attributed to a Russian-speaking initial access broker (IAB) — a specialist who breaches networks and sells verified access to other criminal groups, including ransomware operators and state-aligned espionage actors. The threat actor is believed to be linked to the shinymontanna group, active since at least late 2025, engaging in extortion with ransom demands ranging from $100,000 to $2 million per target.

What distinguishes FortiBleed is the deployment of dedicated GPU cracking infrastructure to crack legacy SHA-256 credential hashes at scale — the first Fortinet-related incident to involve a purpose-built credential marketplace operation of this scope. As Risky Business reported, FortiBleed is far worse than a credentials leak: it is the systematic construction of a verified access inventory for resale into the criminal ecosystem.

CISA and NCSC: The Official Response

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent advisory on June 18, 2026, directing all Fortinet customers to take immediate action. The UK National Cyber Security Centre (NCSC) independently described FortiBleed as a global campaign using brute-force, dictionary attack, and credential stuffing techniques against internet-facing Fortinet firewalls and VPN gateways.

Full Remediation Checklist: What To Do Right Now

If your organization runs any internet-facing Fortinet FortiGate firewall or SSL VPN gateway, treat these as urgent — not advisory:

1. Terminate all active SSL VPN and administrative sessions immediately. Do not wait until the next maintenance window.
2. Reset all Fortinet VPN and administrative passwords — enforce strong, unique credentials with no recycled passwords from any prior breach.
3. Upgrade FortiOS to 7.2.11, 7.4.8, 7.6.1, or 8.0.x, then require every administrator to log in to trigger PBKDF2 re-hashing of stored credentials.
4. Enforce PBKDF2 hashing explicitly using Fortinet’s PBKDF2 enforcement guide and remove all legacy SHA-256 hashes.
5. Enable phishing-resistant MFA on all external gateways and administrative interfaces. MFA alone would have neutralized the entire FortiBleed credential database.
6. Audit all logs — firewall, VPN, authentication, and domain controller — for unauthorized configuration changes, unexpected logins from unknown IPs, and lateral movement indicators.
7. Restrict external management to trusted-host allowlisting at minimum; remove internet-exposed administration entirely where possible.
8. If AD/LDAP integration is configured, treat the integrated account as compromised and monitor Active Directory for lateral movement and unauthorized account creation.

Key Takeaways

• FortiBleed is the largest Fortinet security incident in history: 86,644 devices, 194 countries, active since at least February 2026.
• No new zero-day — the attack exploited unrotated default credentials and a legacy SHA-256 hashing gap that survived firmware upgrades silently.
• 63.3% of compromised credentials were generic or built-in accounts never renamed or rotated.
• Confirmed victims include Samsung, Oracle, NATO contractors, and government agencies across every continent.
• The threat actor is an initial access broker selling verified Fortinet access to ransomware and espionage operators.
• Phishing-resistant MFA on external gateways would have neutralized the entire credential database — stolen passwords become worthless.

Further Reading

• CISA Advisory: Hardening Fortinet Devices After Credential Exposure — Official U.S. government advisory with full technical recommendations and indicators of compromise.
• The Hacker News: CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices — Comprehensive coverage with Fortinet’s official statement and full timeline.
• Arctic Wolf: Active FortiBleed Campaign Technical Analysis — Deep-dive into the PBKDF2 vs SHA-256 hashing vulnerability and remediation steps.
• Recorded Future: Critical FortiBleed Campaign — Threat intelligence analysis of scope, affected sectors, and attacker TTPs.
• NVD: CVE-2024-55591 — FortiOS Authentication Bypass (CVSS 9.6) — NIST National Vulnerability Database entry for the predecessor CVE feeding the FortiBleed credential pool.