Somewhere between espionage and organized crime lies what security researchers are now calling FortiBleed — an industrialized credential-spraying operation so methodically engineered that calling it a "hack" almost undersells the ambition. This wasn't a targeted intrusion. It was a production line, and organizations across the globe were the raw material.
Anatomy of an Automated Attack Factory
The operation came to light in June 2026 after investigators discovered the threat group's own infrastructure sitting exposed on the public internet — an irony that would be amusing if the consequences weren't so severe. What researchers found painted a picture of a sophisticated, multi-operator crew running coordinated attacks at machine scale.
At the core of the campaign was a custom tool designed to mass-spray credentials against Fortinet FortiGate SSL VPN login endpoints. The scope is staggering:
/remote/login endpoints were scanned and targetedA parallel campaign ran simultaneously against over 163,000 Microsoft SQL Server instances, generating an additional 2.1 billion authentication attempts at 50,000 threads. This is not the work of opportunistic hackers — this is the output of an organization with defined roles, shared tooling, and operational discipline.
From Initial Access to Deep Compromise
Once the operators gained a foothold inside a target environment, their playbook escalated quickly. Network sniffers were deployed to harvest credentials transmitted in cleartext across protocols including HTTP, FTP, SMTP, POP3, IMAP, LDAP, SNMP, and Telnet. For encrypted authentication challenges, the group had a solution that money — and a lot of GPU power — can buy.
Intercepted Kerberos and NTLM hashes were routed to a 45-node NVIDIA RTX 4090 cracking cluster orchestrated through Hashtopolis, turning what might have been insurmountable cryptographic barriers into a matter of time and compute cycles.
With cracked credentials and captured session cookies in hand, operators used OpenConnect to hijack live VPN sessions — walking directly into victim environments without ever triggering a fresh authentication event. From there, the post-exploitation activity followed a familiar but devastating pattern: Active Directory enumeration and dumps, file share exfiltration, Kerberos ticket harvesting, and Group Policy template extraction.
Operational Security — Theirs, Not Yours
The group demonstrated a keen awareness of detection risk. Operators worked from Kali Linux virtual machines behind NAT, ensuring their command infrastructure never made direct contact with victim Active Directory environments. Targets were prioritized by annual revenue — with organizations above a $113 billion threshold receiving elevated attention — using open-source intelligence gathering techniques. Multiple operators shared terminal sessions to work the same compromised machines simultaneously.
The one glaring operational failure: their hash-cracking server was left running on default credentials. The same category of mistake they systematically exploit in their victims.
Confirmed Victims and Broader Exposure
At least four organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey have been identified as fully compromised. The most serious allegation involves a Turkish defense contractor with NATO affiliations, from which classified defense documentation is claimed to have been exfiltrated. These attributions remain under investigative assessment and have not been independently confirmed.
The broader exposure picture is equally alarming. The working dataset encompasses nearly 74,000 exposed FortiGate devices across more than 21,600 organizations in 207 countries. India leads in raw device volume; Latin American telecommunications providers carry some of the densest exposed fleets. The sectors bearing the greatest risk are IT services, telecommunications, financial services, and government.
Perhaps the most sobering finding: in a random sample of exposed organizations, 88% already appeared in stealer log or breach databases, and 38% had employees with active infostealer infections at the time of analysis. Approximately 590 of these organizations are already named on ransomware leak sites.
An exposed FortiGate is rarely an isolated vulnerability. It is one visible symptom of an organization that threat actors have already identified, catalogued, and visited more than once.
What You Should Do Now
If your organization operates Fortinet FortiGate devices, treat this as an active emergency, not a future agenda item. Immediate steps include:
- Remove management interfaces and SSL VPN portals from public internet exposure wherever architecturally feasible — this eliminates the primary attack surface
- Rotate all administrator and local credentials on every FortiGate device, and extend that rotation to any account with access to connected systems
- Upgrade FortiOS to the latest supported version and apply all pending security patches
- Invalidate all active VPN sessions immediately — replayed session cookies are a live threat vector, and forced re-authentication closes that window
- Reset employee credentials beyond just firewall accounts — given the high overlap with infostealer infections, assume broader credential compromise within your organization
- Audit your environment for network sniffers on internal segments, particularly on hosts that have had any exposure to public-facing VPN infrastructure
- Cross-reference your domains against the FortiBleed Checker tool released by researchers to assess whether your organization appears in the captured dataset
FortiBleed is a case study in what happens when attackers industrialize the entry phase of their operations. The human attacker becomes a supervisor, not a locksmith. Organizations that have not yet addressed their VPN exposure posture are not waiting to be attacked. In all likelihood, they already have been.
