A sprawling credential-theft operation targeting enterprise firewalls has revealed a disturbing new playbook: attackers are weaponizing the very diagnostic utilities that network administrators rely on to troubleshoot their infrastructure. The campaign, now tracked under the name FortiBleed, has compromised an estimated 430,000 FortiGate firewall devices worldwide — and the methodology behind it is far more sophisticated than a simple password dump.

Threat Alert: A sprawling credential-theft operation targeting enterprise firewalls has revealed a disturbing new playbook: attackers are weaponizing the very diagnostic utilities that network administrators rely on to troubleshoot their infrastructure.

More Than a Credential Leak — This Is an Active Operation

When initial reports surfaced linking FortiBleed to a collection of more than 80,000 firewall URLs and associated VPN credentials, some dismissed it as recycled data from past breaches. What has since emerged tells a different story. Researchers analyzing the campaign's infrastructure have uncovered evidence of an ongoing, methodically executed operation that has been active since at least February 2026.

The threat actor behind this campaign operates as an initial access broker (IAB) — a criminal intermediary that compromises networks and sells that access to other malicious parties. Their workflow combines credential stuffing, brute-force attacks, and offline password cracking into a cohesive, industrial-scale pipeline designed to convert firewall access into monetizable network footholds.

The Sniffer That Turned FortiOS Against Itself

The most technically alarming component of this campaign is a custom Golang-based tool that researchers have named FortigateSniffer. Once attackers gained administrative access to a device — typically through credential stuffing or brute-force — they deployed this tool to pivot from simple access into deep credential harvesting.

FortigateSniffer connects to compromised FortiGate devices over SSH and invokes diagnose sniffer packet, a legitimate FortiOS built-in command designed for network troubleshooting. In the hands of a system administrator, this tool is indispensable for diagnosing routing failures, authentication errors, and connectivity problems. In the hands of a threat actor, it becomes a silent wiretap on every authentication session traversing the firewall.

The tool was designed to monitor traffic across 24 protocols, parse authentication data, and extract credentials from network flows — turning a standard administrative utility into a covert credential harvesting engine.

The targeted protocols read like a comprehensive inventory of enterprise authentication infrastructure: RADIUS, NTLM, Kerberos, LDAP, SMB, RDP, WinRM, Microsoft SQL Server, MySQL, PostgreSQL, SMTP, IMAP, POP3, FTP, and Telnet, among others. Few authentication mechanisms traversing the network appear to have been out of scope.

A Full Pipeline: From Packet Capture to Cracked Passwords

The operation did not stop at packet interception. Researchers have mapped out a multi-stage post-capture processing pipeline that transforms raw network data into actionable credentials.

Stage One: Traffic Reconstruction

Captured packet data was routed through a component called SNIFTRAN, which reassembled the intercepted traffic into PCAP files suitable for deep analysis.

Stage Two: Deep Packet Parsing

A Python-based toolkit — described as a "PCAP Deep Analysis Toolkit" — then processed those files to extract cleartext credentials, NTLM hashes, Kerberos tickets, email credentials, and database authentication artifacts. The toolkit also generated Hashcat-ready output files containing extracted hashes, streamlining the cracking phase.

Stage Three: GPU-Accelerated Password Cracking

Here the operation reveals its true financial investment. The attackers reportedly rented 36 enterprise-class GPUs from a commercial AI compute provider — a level of cracking horsepower that surpasses what many large organizations deploy for their own AI workloads. Using the Hashcat utility across a distributed GPU cluster, the threat actors were able to crack hashed credentials at industrial speed. Separately, researchers noted that hashed credentials were also extracted directly from downloaded FortiGate configuration files, offering a parallel harvesting path that didn't depend on live traffic capture.

Why This Campaign Should Alarm Every Network Defender

Several characteristics of FortiBleed distinguish it from typical opportunistic attacks and demand serious attention from security teams.

Why This Campaign Should Alarm Every Network Defender
Living-off-the-land at the network perimeter: By abusing a legitimate FortiOS diagnostic command, the attackers generated no unusual process execution or foreign binaries on the device itself — a technique that evades many endpoint-centric detection strategies.
Protocol-agnostic harvesting: The breadth of targeted protocols means that even organizations with strong perimeter controls may have had internal authentication traffic — including Active Directory Kerberos exchanges and database credentials — silently intercepted.
Scale of investment signals high ROI: Renting 36 enterprise GPUs is not cheap. The fact that this threat actor made that investment indicates the downstream value of the access being brokered is substantial — likely high-value corporate or critical infrastructure networks.
IAB model amplifies downstream risk: Credentials harvested in this campaign are not necessarily used by the original attacker. They are sold. Organizations breached in this campaign may face follow-on intrusions from ransomware operators, espionage actors, or other criminal groups weeks or months later.

What You Should Do

If your organization operates FortiGate devices, the following actions are not optional — they are urgent.

  • Audit administrative access immediately. Review all administrative accounts on FortiGate devices for unauthorized additions, privilege changes, or anomalous login history. FortiBleed required admin-level access to deploy its sniffer — trace how that access was obtained.
  • Review diagnostic command usage logs. Check FortiOS logs for invocations of the diagnose sniffer packet command by any account that is not a recognized administrator performing documented maintenance. Unauthorized use of this command is a significant red flag.
  • Force credential rotation across connected systems. Given that RADIUS, LDAP, NTLM, Kerberos, and database credentials may have been intercepted, treat any system whose authentication traffic transited a potentially compromised FortiGate as fully exposed. Rotate passwords and invalidate Kerberos tickets accordingly.
  • Cross-reference targeted IP addresses. A list of IP addresses associated with this campaign has been published by independent security researchers. Verify whether any of your FortiGate management interfaces appear on that list and prioritize investigation if they do.
  • Apply multi-factor authentication to VPN and administrative interfaces. Credential stuffing and brute-force — the initial access vectors in this campaign — are dramatically less effective against MFA-protected endpoints. If MFA is not yet enforced on your FortiGate management plane, that gap must be closed immediately.
  • Engage your incident response team. Given the IAB nature of this operation, a compromised FortiGate may already be listed for sale on criminal forums. Treat any confirmed compromise as a precursor to a larger incident and engage IR resources accordingly.

The Broader Lesson

FortiBleed is a stark reminder that attackers no longer need to bring sophisticated malware to a network perimeter intrusion. When legitimate administrative tools can be repurposed into credential wiretaps, the security of edge devices becomes inseparable from the security of everything behind them. Perimeter firewalls have long been treated as the defenders of the network — this campaign demonstrates that a compromised firewall can be turned into its most dangerous adversary.