For organizations that rely on network firewalls as digital gatekeepers, the idea of a firewall becoming the primary source of compromise is both ironic and alarming. A campaign dubbed FortiBleed, active since at least February 2026, hijacked tens of thousands of Fortinet FortiGate firewalls and VPN appliances worldwide. Instead of protecting critical networks, these edge devices bled sensitive credentials and handed attackers the keys to internal systems.
The scale is significant. By mid-2026, attackers had amassed over 86,600 working login credentials across 23,400+ organizations in 194 countries, roughly half of all FortiGate systems exposed to the internet. But the more instructive number isn’t the scale. It’s the method. FortiBleed didn’t require a novel exploit or a zero-day. It required credential stuffing, a packet sniffer, and a GPU cluster. The firewalls did most of the work themselves.
Firewalls Compromized
75,000+
Stolen Credentials
110,000,000
Global Impact
194 Countries
The Attack Chain
No new Fortinet vulnerability was involved. The attackers, a Russian-speaking initial access broker, ran credential stuffing and brute-force attacks against FortiGate devices with admin or VPN interfaces exposed to the internet. Weak passwords, absent MFA, and credentials reused from earlier breaches were enough. By mid-June, roughly 75,000 devices had been compromised via SSH.
With admin access, they installed a custom Golang tool called FortigateSniffer that abused FortiOS’s built-in packet capture feature, a legitimate diagnostic function, to monitor all traffic flowing through the firewall. The sniffer filtered for over 20 authentication protocols: RADIUS, LDAP, Kerberos, NTLM, database logins, email protocols. It extracted credentials and password hashes from live network traffic without touching endpoints or triggering most detection logic. In parallel, the attackers pulled FortiGate configuration files to retrieve local admin account hashes.
Captured data was processed offline. A Python parser extracted and formatted credentials, fed into Hashcat running on a rented 36-GPU cloud cluster. In two weeks: 14.8 million unencrypted RADIUS secrets, over a million NTLM and Kerberos hashes, tens of millions of database passwords. A darknet post advertising 35,000 stolen Fortinet credentials appeared shortly after the campaign surfaced. The attackers saw a 90% credential validation rate in early cycles, a figure that reflects the state of privileged access hygiene at the network edge, not the sophistication of the attackers.
A Firewall is a Vantage Point, Not Just an Appliance
A firewall or VPN gateway straddles both sides of the network. Compromise it and you get a position that sees authentication exchanges across the internal environment, has standing connectivity to critical systems, and carries the implicit trust of a legitimate administrative session. FortigateSniffer was productive because the firewall was already doing privileged work: monitoring traffic, processing authentication, managing connectivity. The attacker didn’t need to move laterally in any conventional sense.
FortiBleed exposed a structural condition that exists well beyond Fortinet. Organizations invest heavily in hardening the perimeter, then route their most sensitive operations through it. Admin sessions, privileged credentials, authentication exchanges, the exact material needed to move deeper into a network, all flow through the same device most exposed to the internet. When that device is compromised, it doesn’t just fail. It becomes a collection point.
Traditional network architecture assumes the firewall holds. FortiBleed is a case study in what happens when that assumption breaks and nothing behind it is designed to contain the fallout.
Hardening Alone Doesn’t Contain the Blast Radius
Patching, enabling MFA, and rotating credentials all reduce the probability of initial access. None of them change what an attacker inherits if they get in anyway. The question worth asking after FortiBleed is how much internal credential traffic a compromised edge device can see, and whether that’s a configuration problem or something baked into the architecture.
Separating where sensitive operations happen from where exposure is highest is the intervention that actually changes the outcome. Admin sessions and privileged access workflows carry a different risk profile from general network operations. Running them in the same environment as internet-facing management interfaces means a single compromised device can reach everything behind it. FortiBleed’s credential feedback loop, where initial access to a FortiGate leads to harvesting internal authentication traffic and then broad lateral movement, only works when those layers aren’t separated. Isolation breaks the chain.
Three specific controls would have degraded FortiBleed’s yield significantly:
- Management interfaces should be off the public internet entirely, accessible only through internal networks or dedicated administrative channels. FortiBleed exploited consoles that were reachable from outside by default and apparently stayed that way.
- Edge devices should have limited visibility of internal credential traffic. The FortiGate’s broad access to RADIUS secrets and Active Directory authentication exchanges is what made the sniffer so productive. If the firewall doesn’t need that access to do its job, it shouldn’t have it. Segmenting what flows through the management plane versus the data plane reduces how much any one device can expose.
- Privileged sessions should run in environments isolated from general network operations. Admin access to firewalls, VPN gateways, and identity systems carries enough risk to warrant its own contained environment. Not because those systems are assumed compromised, but because the consequences of compromise are too broad when everything runs through the same plane. Containing that work to isolated sessions limits what an attacker can reach even after initial access succeeds.
FortiBleed is a Template, Not an Outlier
The attackers’ playbook, credential stuffing combined with built-in diagnostic tools repurposed as sniffers and offline cracking at scale, is already being applied to other VPNs, RDP gateways, and network appliances. It works because the structural conditions that made it work at Fortinet exist broadly: privileged operations running through exposed devices, management interfaces reachable from the internet, no isolation layer between edge compromise and internal credential exposure.
Perimeter hardening reduces the probability of initial access. Containment reduces what an attacker can do after they have it. Most security architectures are heavy on the first and thin on the second, which is why campaigns like FortiBleed keep producing results at scale.
