Since February 2026, a Russian-speaking broker has run a mass credential-harvesting campaign against over 430,000 FortiGate firewalls using a Golang sniffer called FortigateSniffer and brute-force tools. Harvested cleartext passwords and hashes feed an automated pipeline for cracking, lateral movement and data exfiltration across SMBs, with operations geofenced and time-restricted to avoid detection.

• FortiBleed compromised 430,000+ FortiGate firewalls since February 2026 using a Golang sniffer (FortigateSniffer) that taps FortiOS's diagnose sniffer command to capture credentials across 24 protocols.
• Over just 15 days (May 31-June 15), 659 parallel pipelines harvested 14.8 million RADIUS credentials, 924,000 NTLM hashes, 130,000 Kerberos hashes, and 89 million MySQL tokens.
• No zero-days involved—Fortinet confirms weak passwords and missing MFA are the actual root cause, not a software vulnerability.
• The campaign extends beyond Fortinet to Synology, Sophos, Citrix, RDWeb and MS-SQL targets, prioritizing SMBs under 200 employees and IT service providers, with possible use of AI tools (CyberStrike/CyberStrikeAI) to automate scanning.