FortiBleed: Everything You Need to Know

FortiBleed is an active, large-scale credential-theft campaign that has harvested and verified 86,644 Fortinet-related credentials across ~80,000 IPs and 22,405 domains in 194 countries. Attackers perform credential stuffing using prior breach dumps and infostealer logs, then use compromised devices as passive listening posts to harvest more credentials, impacting firewalls and SSL VPNs; remediation guidance includes immediate password rotation, MFA, restricting management access, forensic incident response, and continuous monitoring.