Since February 2026, a Russian-speaking broker has run a mass credential-harvesting campaign against over 430,000 FortiGate firewalls using a Golang sniffer called FortigateSniffer and brute-force tools. Harvested cleartext passwords and hashes feed an automated pipeline for cracking, lateral movement and data exfiltration across SMBs, with operations geofenced and time-restricted to avoid detection.

• FortiBleed compromised 430,000+ FortiGate firewalls since February 2026 using a Golang sniffer (FortigateSniffer) that taps FortiOS's diagnose sniffer command to capture credentials across 24 protocols.
• Over just 15 days (May 31-June 15), 659 parallel pipelines harvested 14.8 million RADIUS credentials, 924,000 NTLM hashes, 130,000 Kerberos hashes, and 89 million MySQL tokens.
• No zero-days involved—Fortinet confirms weak passwords and missing MFA are the actual root cause, not a software vulnerability.
• The campaign extends beyond Fortinet to Synology, Sophos, Citrix, RDWeb and MS-SQL targets, prioritizing SMBs under 200 employees and IT service providers, with possible use of AI tools (CyberStrike/CyberStrikeAI) to automate scanning.

CISA warns that a Russian-speaking threat actor has harvested 86,644 valid logins from internet-facing FortiGate firewalls and VPNs using SSL VPN interception, GPU-powered hash cracking, and brute-force attacks. Major government entities and critical infrastructure providers are affected. CISA advises resetting credentials, enforcing PBKDF2 for admin logins, enabling phishing-resistant MFA, and tightening management access.

• 86,644 valid FortiGate credentials—about half of all internet-exposed Fortinet devices—were harvested via SSL VPN interception and GPU-cracked passwords, hitting government and critical infrastructure targets across 194 countries.
• Attackers ran 1.16 billion credential checks against 320,000 FortiGate devices and 2.1 billion brute-force attempts on 160,000+ Microsoft SQL servers, fully compromising at least four organizations.
• Huntress found 845 of its partner organizations directly affected by matching leaked IPs against its own data.
• CISA is urging immediate credential resets, session termination, a switch to PBKDF2 for admin password storage, phishing-resistant MFA, and locking down management interfaces to known IPs.