Russian Initial Access Broker Behind FortiBleed Campaign

SOCRadar and researchers uncovered 'FortiBleed', an ongoing large-scale credential-harvesting campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPNs that has collected 86,644 verified credentials and 110M+ captured items across ~194 countries; attackers use mass scanning and brute-force/credential-stuffing to deploy a Golang 'FortigateSniffer' to capture cleartext credentials, then run a GPU-backed cracking pipeline, perform lateral movement and exfiltration, and may collaborate with or sell access to state-aligned groups—organizations are advised to rotate credentials, enable MFA, remove public management interfaces, upgrade FortiOS to versions with PBKDF2 hashing, and engage incident response if indicators are found.