FortiBleed Campaign Exposes Credentials for Roughly 86,000 FortiGate Devices Across 194 Countries as CISA Urges Immediate Password Resets
A credential-harvesting campaign dubbed FortiBleed reached 86,644 compromised FortiGate devices across 194 countries by June 19, prompting a CISA hardening advisory.
Overview
A large-scale credential-harvesting campaign against internet-facing Fortinet firewalls, dubbed FortiBleed, had climbed to 86,644 unique compromised devices by June 19, 2026, according to Shattered Security. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a hardening advisory on June 18 urging Fortinet customers to terminate active sessions and reset credentials, as reported by SecurityWeek and Cyber Security News.
The exposed dataset spans 194 countries, making it one of the most globally distributed credential-exposure events on record, according to Shattered Security.
What We Know
The campaign was identified by security researcher Volodymyr “Bob” Diachenko on June 13, 2026, after he stumbled onto an exposed threat-actor server, according to Recorded Future and Shattered Security. Diachenko attributed the operation to a Russian-speaking threat group, according to Recorded Future.
The attackers worked from device configuration files rather than a single software flaw. Threat actors “systematically collected configuration files from internet-facing Fortinet FortiGate firewalls and used them to recover working administrator credentials” through offline password cracking, according to CSO Online. Recorded Future’s Insikt Group reported the operation conducted approximately 1.16 billion credential attempts against 320,777 FortiGate targets and used a 45-GPU cluster managed through Hashtopolis to crack hashes and recover plaintext credentials, according to Recorded Future.
“They intercept SSL VPN authentication, crack hashes on a 45-GPU cluster managed via Hashtopolis, and pivot into internal Active Directory environments,” Diachenko said, according to SecurityWeek. Kevin Beaumont and Hudson Rock independently verified the credentials, according to SecurityWeek.
The root cause traces to legacy password storage. Fortinet introduced PBKDF2-based password hashing for administrator credentials in FortiOS 7.2.11, 7.4.8, and 7.6.1, replacing the legacy SHA-256-based storage mechanism, according to Arctic Wolf. However, existing administrator passwords remain stored as SHA-256 hashes until administrators log in after upgrading, according to CSO Online. Cyber Security News reported that the actors were recycling credentials from two previously documented incidents tracked as FG-IR-26-060 and FG-IR-25-647, pairing them with AI-accelerated brute-force techniques against exposed devices that lack strong credential controls, according to Cyber Security News.
CISA’s advisory urges Fortinet customers to take hardening actions including terminating active sessions and resetting credentials, ensuring admin logins are stored using the PBKDF2 algorithm, reviewing logs to identify suspicious activity, enabling phishing-resistant multi-factor authentication, and locking down management access to reduce the attack surface, according to SecurityWeek. Recorded Future similarly recommends rotating all FortiGate admin and SSL VPN credentials immediately, enforcing multi-factor authentication on all remote and administrative access, restricting or removing internet exposure for management interfaces, and patching FortiOS, according to Recorded Future.
Scale
Estimates of the campaign’s reach vary by methodology. SOCRadar identified verified working administrator credentials for between 30,000 and 75,000 devices across 194 countries, according to Arctic Wolf. CSO Online reported the campaign exposed roughly 75,000 FortiGate firewalls, approximately 50% of internet-facing Fortinet firewalls visible on Shodan, spread across 194 countries and more than 21,000 domains, according to CSO Online. Recorded Future tracked approximately 73,932 FortiGate firewall URLs across 194 countries, according to Recorded Future. Cyber Security News reported the campaign impacts up to 86,000 internet-facing FortiGate firewalls and VPN appliances, according to Cyber Security News. The top affected countries were India, the United States, and Mexico, according to CSO Online.
What We Don’t Know
The figures reported across vendors differ depending on whether they count internet-exposed devices, devices whose configuration files were harvested, or credentials that were successfully cracked into working logins, and the totals continued to climb as researchers indexed the dataset. The full extent of follow-on intrusions into the affected organizations’ internal networks has not been publicly quantified.
Analysis
FortiBleed reflects a pattern that has dominated 2026’s breach reporting: attackers increasingly authenticate with valid credentials rather than exploiting a single unpatched vulnerability. Because the cracked logins are legitimate administrator credentials recovered from device configuration files, simply applying the latest firmware is insufficient. As Arctic Wolf notes, multi-factor authentication should be enforced on all administrative and remote access accounts, and administrators must log in to the firewall at least once after upgrading to ensure passwords are re-stored using PBKDF2 rather than the legacy SHA-256 hashes that made the offline cracking possible.