FortiBleed: 30,791 Fortinet Firewalls Compromised in Global Credential Heist

FortiBleed is an active, large-scale campaign delivering verified admin credentials for Fortinet firewalls and VPN gateways (≈30,791 devices across 194 countries). Attackers automate internet scanning and credential stuffing using reused credentials from prior leaks, convert compromised devices into passive harvesters that feed new credentials back into the scanner, and target critical sectors; SOCRadar rates the campaign Critical and advises immediate password rotation, MFA on admin/VPN accounts, and removal of management interfaces from the public internet.