Hackers Using FortigateSniffer Tool That Turns Compromised Firewalls Into Password Collectors

SOCRadar reports a large-scale, financially motivated campaign named “FortiBleed” in which attackers deployed a custom Golang tool (FortigateSniffer) on FortiGate firewalls worldwide to passively sniff and exfiltrate credentials across dozens of protocols; the operation harvested an estimated 110+ million credentials from over 430,000 appliances, used sophisticated targeting, evasion and cracking infrastructure, and includes confirmed targeted exfiltration from a NATO-aligned defense contractor, with multiple IoCs and active infrastructure identified.