FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist

FortiBleed is a sophisticated, large-scale campaign that compromises Fortinet FortiGate devices to deploy a Golang-based sniffer (FortigateSniffer) which abuses the legitimate 'diagnose sniffer packet' command to capture credentials across ~24 authentication protocols. Captured data are reconstructed into PCAPs, parsed for cleartext credentials and hashes, and fed into a massive GPU cracking cluster; cracked credentials are recycled into automated lateral access scanners, producing over a billion credential attempts and sales of ~86,644 verified credentials. The campaign includes post-exploitation tunneling tools (Chisel, Neo-reGeorg), targeted data exfiltration (including a NATO-aligned contractor), and actionable IOCs and mitigation steps including rebuilds, credential rotation, and FortiOS upgrades.