Since February 2026, a Russian-speaking broker has run a mass credential-harvesting campaign against over 430,000 FortiGate firewalls using a Golang sniffer called FortigateSniffer and brute-force tools. Harvested cleartext passwords and hashes feed an automated pipeline for cracking, lateral movement and data exfiltration across SMBs, with operations geofenced and time-restricted to avoid detection.