It doesn't announce itself with ransomware notes or dramatic data dumps. It listens. Quietly, methodically, and within the boundaries of normal business hours, a sophisticated credential-harvesting operation has been bleeding enterprise networks dry — and the full scope of the damage is only now coming into focus.
The campaign, now designated FortiBleed, represents one of the most operationally mature credential-theft operations documented in 2026. With more than 430,000 FortiGate firewall devices targeted, over 110 million credentials captured across 659 distinct harvesting pipelines, and at least one confirmed breach of a NATO-aligned defense contractor, this is not a campaign that can be dismissed as opportunistic noise. It is deliberate, disciplined, and still active.
A Five-Stage Kill Chain Built for Scale
What distinguishes FortiBleed from the typical spray-and-pray credential operation is the degree of operational planning baked into every phase. Investigators reconstructed a five-stage attack chain that reveals an actor thinking in terms of efficiency and return on investment, not just access.
Stage 1: Reconnaissance and Target Ranking
The operation begins with mass port sweeping via Masscan, supplemented by passive enrichment through a custom-built Shodan reconnaissance tool. A purpose-built binary — internally referred to as FortiProbe-fast — filters confirmed FortiGate devices from millions of raw scan results. Critically, targets are then ranked by estimated annual revenue before any exploitation resources are allocated. This isn't opportunistic. It's a prioritization model that mirrors how legitimate sales organizations qualify leads.
Stage 2: Initial Access via Brute Force and Credential Stuffing
Entry is gained through SSH brute-force attacks using sixteen wordlists curated specifically for FortiGate administrator account naming conventions, paired with credential stuffing campaigns against SSL-VPN portals. The specificity of those wordlists indicates prior knowledge of FortiGate deployment patterns — not a generic toolkit repurposed for the task.
Stage 3: Passive Sniffing Without Malware Deployment
The operational centerpiece is a Golang-based tool that abuses a legitimate FortiOS diagnostic command to passively capture authentication traffic. Across 24 protocols — including Kerberos, RADIUS, NTLM, RDP, LDAP, and MSSQL — the sniffer vacuums credentials from every device it touches without deploying a single piece of traditional malware. This is a significant evasion achievement: no payload, no signature, no conventional indicator of compromise.
The sniffer operates exclusively between 07:00 and 18:00 Moscow Time — a calculated decision to blend malicious traffic collection into the rhythmic noise of normal business-hours network activity.
Stage 4: Distributed Hash Cracking
Captured authentication hashes are fed into a distributed GPU cracking cluster managed via Hashtopolis, with Hashcat serving as the underlying engine. Real-time telemetry is delivered to a single hardcoded operator via a Telegram bot. The actors supplemented their own hardware by renting additional GPU capacity through commercial cloud computing marketplaces — a cost-effective scaling strategy that keeps infrastructure overhead low.
Stage 5: Lateral Movement and Targeted Exfiltration
In at least one documented case, cracked Kerberos hashes triggered lateral movement into Active Directory environments within minutes, culminating in the targeted exfiltration of DFS backup data from a defense contractor with NATO affiliations. The speed of post-compromise activity suggests automated or near-automated playbooks waiting on successful hash cracks.
Infrastructure Built for Durability
The operation's backend infrastructure spans loosely regulated Eastern European micro-hosting providers, segmented across four distinct subnet blocks serving separate operational functions: command-and-control aggregation, credential validation, sniffer deployment, and proxy rotation. The pentest environment itself runs seven Kali Linux virtual machines under QEMU/KVM, hardened with strict firewall rules and configured for multi-operator access through shared terminal sessions.
At the time of the most recent analysis, the campaign was still actively sniffing more than 19,000 devices, part of a broader identified target pool exceeding 80,000 systems.
Who Is Being Targeted — and Why It Matters
The victim profile skews sharply toward small and mid-sized organizations: approximately 66% of affected entities employ fewer than 200 people, and nearly 90% report annual revenues below $100 million. Geographic concentration is highest in India, the United States, and Taiwan, which together account for roughly a third of affected domains.
IT services firms are the most frequently targeted sector — a strategic choice. Compromising a managed service provider creates cascading downstream access into every customer environment that provider touches. It is supply-chain leverage without a supply-chain attack.
Tooling comments written in Cyrillic script point toward Russian origin. The actor profile aligns with an Initial Access Broker model, where harvested credentials and network footholds are packaged and sold to ransomware groups. The targeting of a NATO-aligned defense contractor, however, raises a harder question: whether some access is being selectively retained or shared with state-adjacent actors rather than sold on criminal marketplaces.
What You Should Do
The Bigger Picture
FortiBleed is a masterclass in what patient, well-resourced threat actors can accomplish when they prioritize stealth over speed. No ransomware. No dramatic intrusion. Just a quiet, persistent drain on the authentication fabric of thousands of organizations — most of which have no idea it happened.
The absence of malware deployment is particularly instructive. Defenders who rely on endpoint detection as their primary control are flying blind against an operation that never touches the endpoint. Network-layer visibility, behavioral analytics, and credential hygiene are no longer optional layers — they are the primary line of defense against this class of threat.
With over 19,000 devices still actively being sniffed as of the latest reporting, the window to act is not theoretical. It is open right now.
