FortiBleed: The Most Detailed Breakdown Yet of an Active Russian Credential-Harvesting Operation

**FortiBleed: large-scale credential-harvesting campaign targeting FortiGate firewalls** — SOCRadar’s report details an active, sophisticated operation that targeted 430,000+ FortiGate devices, collected ~110 million credentials via a Golang sniffer and brute-force/credential-stuffing, cracked hashes with distributed GPU resources, and enabled at least one confirmed breach of a NATO-aligned defense contractor; the report maps the full five-phase attack chain, infrastructure, and mitigation steps.