What happens when the very devices organizations deploy to defend their networks become instruments of mass credential theft? That question is no longer theoretical. A sprawling, ongoing attack campaign has transformed hundreds of thousands of FortiGate firewall appliances into covert surveillance tools, quietly siphoning authentication data at a scale that should alarm every security team running Fortinet infrastructure.
A Weapon Built for the Job
At the center of this campaign is a purpose-engineered packet sniffer written in Go — a language increasingly favored by threat actors for its portability, performance, and the relative difficulty defenders face when reverse-engineering compiled Go binaries. Unlike opportunistic malware that repurposes off-the-shelf components, this tool was deliberately crafted to operate inside compromised FortiGate environments, passively intercepting network traffic as it flows through the firewall's privileged position on the network perimeter.
The implications of that positioning cannot be overstated. Firewalls sit at the intersection of internal and external traffic, making them uniquely valuable targets for credential interception. A sniffer resident on a compromised gateway doesn't need to break encryption or pivot through the internal network — it simply watches, collects, and exfiltrates the authentication data that passes through it naturally.
The Numbers Behind the Campaign
The operational scope here is extraordinary. Researchers tracking the campaign have identified approximately 430,000 FortiGate devices that have been drawn into the attackers' net, with credential harvesting activity producing a staggering yield of more than 110 million captured credentials. These aren't estimates rounded to the nearest order of magnitude — they reflect a methodical, persistent operation that has been accumulating access over an extended period.
When a single campaign can extract over 110 million credentials from network perimeter devices, the downstream risk extends far beyond the organizations directly compromised — it creates a reservoir of valid authentication data that feeds phishing, account takeover, and supply chain attacks for months or years to come.
The scale also suggests this is not the work of a loosely organized criminal collective running automated exploits. The engineering investment in a custom Go-based sniffer, combined with the operational discipline required to maintain persistence across hundreds of thousands of devices, points to a well-resourced threat actor with clear objectives and the infrastructure to support them.
Why FortiGate Devices Remain Attractive Targets
Fortinet's FortiGate line is among the most widely deployed enterprise firewall platforms globally, and that ubiquity makes it a high-value target environment. Over the past several years, Fortinet products have been the subject of multiple critical vulnerability disclosures — including flaws enabling unauthenticated remote code execution and authentication bypass. While patches have been made available, the reality of enterprise patch cycles means that a significant portion of deployed appliances operate on outdated firmware at any given time.
Threat actors, both financially motivated criminal groups and state-sponsored operators, have demonstrated a consistent pattern of weaponizing Fortinet vulnerabilities rapidly after public disclosure — and sometimes before. Once an attacker achieves initial access to a FortiGate device, the combination of its network visibility, privileged operating environment, and often-limited endpoint detection coverage makes it an ideal host for persistent, low-noise collection tools like the sniffer identified in this campaign.
The Persistence Problem
Perhaps the most operationally significant detail emerging from this campaign is that it is ongoing. This is not a historical breach being disclosed months after remediation. Organizations that have not audited their FortiGate deployments for indicators of compromise may currently be running compromised devices that are actively harvesting credentials transiting their networks.
Persistence on network appliances is notoriously difficult to detect and eradicate. Unlike endpoints that receive regular antivirus scans and EDR telemetry, firewall appliances often exist outside standard security monitoring workflows. Attackers exploiting this blind spot can maintain footholds for extended periods — quietly collecting data while defenders remain unaware.
What You Should Do
The Broader Strategic Warning
This campaign is a vivid illustration of a threat model that the security industry has long warned about but that many organizations still underweight: network security appliances are not inherently trustworthy by virtue of their function. They are complex software systems running on general-purpose hardware, and they carry vulnerabilities like any other platform. The difference is that their privileged network position and limited monitoring coverage make them extraordinarily high-value targets when those vulnerabilities are exploited.
Security leaders who treat perimeter appliances as the boundary of their threat model — rather than as potential threat surfaces within it — are operating with a fundamental blind spot that campaigns like this one are specifically engineered to exploit.
