FortiBleed: Tens of Thousands of Fortinet Credentials Leaked

Threat Intel
,
1

Last Updated: 2026-06-19T22:09:29Z

What’s Happening

Hudson Rock (Infostealers.com) is reporting a massive dataset of compromised Fortinet credentials and logs associated with exploitation. The dataset comprises 73,932 unique firewall URLs across 21,632 domains.

How were these credentials acquired? Fortinet says they were intercepting and cracking SSLVPN authentication. This was later refuted by reviewing attacker logs and infrastructure. Admin portals were compromised via brute-force and shared creedentials. Then, user password hashes were cracked offline using a rented 36-GPU cluster.

Kevin Beaumont has a blog about the incident, clarifying that the dump of information appears to be from exposed Fortinet management consoles. Although the exact exploit method is unknown, data was apparently exfiltrated from the consoles and then cracked offline.

Bob Diachenko, the original researcher, has posted some updates about the attack.

The scale of the brute force effort is notable. Additionally, other devices were targeted in the campaign, including Sophos and MSSQL.

CloudSEK has released a post detailing the campaign operator’s infrastructure since they

left their own back-end server exposed to the internet with an open, browsable directory. That server held not only a database of validated credentials but also the group’s tooling, automation scripts, connection strings, scheduled jobs, and operator command histories.

fortibleedmethod
fortibleedmethod1000×1180 91.8 KB

They also found heavy credential reuse across affected corporations.

credential_reuse
credential_reuse2048×1135 168 KB

Cloudsek also contests Hudson Rock/Diachenko’s claim of “compromised” hosts. Money quote:

The central findings of the analysis is that the 21,632 figure that generated the headlines is the count of entries in the attacker’s FortiGuard email attribution database, a device registration catalogue, not a verified breach list. When traced back through the attacker’s own tooling, only 918 organisations show evidence of Kerberos traffic being captured from inside their networks, meaning the operators actually reached internal Active Directory infrastructure in fewer than 5% of attributed cases. Of those 918, only 148 ~0.68% of the headline figure represent confirmed compromises where Kerberos hashes were fully cracked and AD credentials were verified. Not one of the headline victims named in the original reporting appears in that confirmed list.

Which may be so, but that’s not the only issue with the dump.

Kevin Beaumont has responded to the CloudSek post with further context, and a full list of compromised IPs.

Beaumont’s direct experience with victims is relevant here. He points out that full compromise and possession of credentials are not the same, especially when the creds are up for sale.

He’s also listed some IPs from which he has seen config exports:

193.8.186.7
80.75.212.113
213.21.239.65
208.94.246.58
69.195.129.144
96.45.42.173

Actions

Despite the obvious marketing hype, Fortinet customers should use Hudson Rock’s tool to check the dataset for their domains.

More usefully, the beautiful folks at GAYINT have made the entire list available!

If impacted, the following actions should follow immediately:

  1. Forced credential rotation for SSL VPN users
  2. In parallel, threat hunting and incident response playbooks should initiate, assuming breach. Rotated creds are unhelpful in an active compromise.
  3. Enforce universal multi-factor authentication (if not already done).
  4. Log monitoring for suspicious authentications/lateral movements.

If not impacted, still take a moment to review the list for organizations in your community. This is widespread enough that it’s almost certain an organization that impacts you locally was involved. And it’s no sure thing they’ll notice this report. Search town/community names, local colleges and schools, etc. A moment to send an email to their security team or administration would be a kindness.

Some ideas for searching:

  • Municipal government
  • Utilities
  • K-12 Schools
  • Colleges/Universities
  • Museums
  • Hospitals
  • Smaller healthcare organizations
  • Places of worship

Notes

This is a good reminder to update priors about hash strengths—as I had to for this one. Salted SHA256 is insufficient for secure password storage. As Beaumont notes, recent versions of FortiOS moved to hashing with PBKDF2, but only per-login of admins.

Beaumont says:

There needs to be a better system for threat intelligence which isn’t private companies hoarding attacker data.

We couldn’t agree more. That’s why we started IFIN.

Errata

  • Clarified nature of dump and hypothesis for attack methods with new analysis
4 Likes
2

Fortinet has a history of not properly validating certificates. For example, in CVE-2021-41028 they only checked if the server used a cert signed by their CA; they not only used a hardcoded certificate, but Forticlient would even accept the RSA-512 cert hardcoded into Fortigate 3.x.

(Why did I never publish that? I have the writeup mostly done, I need to publish that.)

But my point is they may have been able to MITM the traffic.

1 Like
3

If the SSL VPN client didn’t validate certs, that would be egregiously negligent.

1 Like
4

Possible idea to have here since HudsonRock doesn’t offer one, and not everyone has experience in professional disclosure, a copy and paste-ish email template that is unlikely to be seen as hostile or result in legal action against anyone trying to disclose in good faith

1 Like
5

The article recommends upgrading the hashing protocols but (like with so many other publications like this) doesn’t say how

So here, let me help out anyone who currently works with FortiGate’s:

Open the terminal (either in the GUI or SSH)

config system global
     set ssl-static-key-ciphers disable
     set strong-crypto enable
end

It’s also a good idea to enable Single CPU Core Overload Event Logging so you can monitor things like password-spray or DDoS attempts:

config system global
     set log-single-cpu-high enable
end

And as always, make sure you have a decent password policy and you disable the built-in admin account and disable telnet. Those last two have to be done from the terminal and the fact that Fortinet enables them by default and doesn’t give you an easy way to turn it off is infuriating.

Password Policy:

config system password-policy
     set status enable
     set apply-to admin-password ipsec-preshared-key
     set minimum-length 25
     set min-lower-case-letter [# of minimum required lower case letters]
     set min-upper-case-letter [# of minimum required upper case letters]
     set min-non-alphanumeric [# of minimum required symbols]
     set min-number [# of minimum required numbers]
     set min-change-characters [# of minimum non-contiguous characters in a row]
     set expire-status enable
     set reuse-password disable
     set admin-lockout-threshold 3
     set admin-lockout-duration 900
end

Disable admin account (before doing this one, make sure you have another admin account that’s not called “admin”):

config system admin
     delete admin
     edit "[new admin name]"
          set trusthost1 [IP address of the trusted machine that is authorized to use this account]
          set acctprofile "super_admin"
          set vdom "mgmt" (if you use a management VDOM. Ignore if you don't)
          (I've had issues with setting the password in the terminal where it doesn't encrypt properly, so I just set it in the GUI)
     next
end

Disable telnet:

config system global
     set admin-telnet disable
end
5 Likes
6

As noted on Fedi, the search tool is rather limited. The API is open and directly accessible. It is also paginated.

https://www.hudsonrock.com/api/json/v2/stats/website-results/fortinet-domains/search?q=school&page=2

If "hasMore":true is in the returned JSON object, there’s more to find.

UPDATE: Nevermind, that page param doesn’t work either. Thanks, Hudson Rock.

7
2 Likes
8

Thanks! Added to the main post.

9

Looks like the API is being pretty heavily rate-limited. I only made 3 or 4 queries before getting an error 1015 from CloudFlare. I suspect it’s getting hammered pretty hard.

10

See the list above. Much easier!

11

Well, I’ve got one municipality notified via backchannel. They don’t seem to have a front door for this kind of thing. But the IT guy for the county has multiple text messages from a member of the sheriff’s dept.

Hopefully they call tomorrow.

5 Likes
12

I appears that the server hosting the list of IPs provided by Beaumont may be filtered or mis-routed by some US ISPs. Here’s a copy if you can’t get to it directly.

some-fortibleed-ips.txt (962.6 KB)

2 Likes