FortiBleed: Massive Credential Leak Campaign Exposes Over 30,000 Fortinet Devices Worldwide

FortiBleed and the Stark Warning for Enterprise Security Systems

The FortiBleed campaign is sending shockwaves through the global cybersecurity community. It is a large-scale credential harvesting operation targeting Fortinet FortiGate firewalls and VPN gateways. With more than 30,000 devices already compromised and a verified database of active login credentials, this incident poses a severe threat to businesses, government organizations, and critical infrastructure worldwide. Once again, exposing security devices directly to the internet has proven to be a fatal mistake.

How the FortiBleed Campaign Was Discovered

In mid-June 2024, security researchers detected signs of a highly organized active campaign. They named it FortiBleed. The threat actors used sophisticated methods to extract configuration files from publicly exposed FortiGate devices on the internet. After obtaining these files, they cracked the stored password hashes.

As a result, attackers now possess tens of thousands of valid administrator credentials. This was not random password spraying but a targeted attack that directly exploited configuration data and stored secrets.

The Massive Scale of the FortiBleed Data Breach

The leaked data contains exactly 30,791 verified active Fortinet login credentials. Independent research estimates the actual impact could reach approximately 75,000 devices. Alarmingly, the entire dataset was professionally organized by country, industry, and organizational revenue. This systematic categorization indicates the campaign was carried out by a highly organized group, not amateur hackers.

In reality, the true number may be significantly higher as many organizations have not publicly disclosed breaches or have yet to detect signs of compromise.

Global Impact of the FortiGate Security Breach

The FortiBleed campaign has spread across 194 countries and territories. From multinational corporations in the United States and Europe to government agencies in Asia, Africa, and South America – all have been targeted. Beyond private enterprises, numerous state organizations and critical infrastructure have also been affected.

This is clearly not a localized incident or limited to a specific industry. Instead, it represents a large-scale intelligence-gathering operation that could serve as a foundation for future attacks such as ransomware, APTs, or cyber espionage.

How the Credential Harvesting Attack Works

Unlike traditional brute-force attacks, FortiBleed focuses on exploiting device configuration files. When a FortiGate is exposed to the internet via its management port (typically HTTPS port 443 or 10443), attackers attempt to download the encrypted config file. This file contains password hashes and other authentication data.

After decrypting and cracking the hashes (especially weaker ones found in older FortiOS versions), attackers obtain actual usernames and passwords. This method is far more effective than mass password guessing because it directly leverages secrets already stored on the device.

Sensitive Information Collected and Potential Risks

The exposed data includes administrator credentials, VPN accounts, and in some cases, admin emails, plaintext passwords, and session information. With this data, attackers can easily access internal networks, perform lateral movement, deploy ransomware, or steal sensitive information.

A real-world example involves hospitals using FortiGate to connect PACS systems and electronic medical records. If VPN accounts are abused, the personal health data of millions of patients could be stolen or encrypted for ransom.

Why Fortinet Users Must Act Immediately

The greatest danger of Fortinet credential leaks is that compromised credentials remain valid even after patching. Many organizations believe updating firmware is sufficient, but failing to change all administrative and VPN passwords leaves the backdoor wide open.

Attackers can use these credentials to bypass firewalls, establish persistence, or sell the data on the dark web. The risk is even higher for organizations in finance, energy, healthcare, and government sectors – frequent targets of APT campaigns.

Emergency Response Recommendations for Businesses

To immediately reduce risk, organizations should take the following actions:

• Immediately change all administrative and VPN passwords on every FortiGate device, especially those exposed to the internet.
• Enable Multi-Factor Authentication (MFA) for all administrative and VPN accounts.
• Minimize exposure of management interfaces to the internet. Allow access only from internal IPs or through properly secured VPNs.
• Review device logs for signs of suspicious logins, configuration changes, or anomalous traffic.
• Deploy continuous monitoring solutions (SIEM) to detect lateral movement within the network early.

Technical Recommendations from Vendors and Experts

Fortinet recommends that all users upgrade to the latest FortiOS version to address related vulnerabilities. After upgrading, all administrators must log in again to migrate to stronger encryption mechanisms.

For FortiOS 7.2.x and 7.4.x versions, enable the “login-lockout-upon-weaker-encryption” setting to completely remove any remaining weak SHA-256 hashes from old passwords. Additionally, enabling strong password policies and conducting regular configuration audits is essential.

Key Lessons and the Broader Context of FortiBleed

This is one of the largest publicly disclosed firewall credential leak campaigns in recent years. It underscores that patching software alone is insufficient if exposed credentials are not thoroughly changed. FortiBleed is a clear example of the risks of exposing critical security devices directly to the internet without proper protection layers.

In an era of increasing credential-based attacks, organizations must shift from “defense-in-depth” to a genuine Zero Trust model, combined with continuous monitoring and strict identity management. Details about this campaign can be found in the original article on Cybernews.