InfoSecBulletin Cybersecurity for mankind
A vast cyber spying operation called “FortiBleed” has quietly compromised more than 73,932 different Fortinet firewall URLs in 194 countries.
Originally discovered by security researcher Volodymyr “Bob” Diachenko, with more study from Hudson Rock and cyber expert Kevin Beaumont, this dataset shows a huge, automated scheme. Bad actors managed to hit 73,932 different firewall URLs in 194 countries, leading to 21,632 unique affected domains. Shockingly, as Beaumont pointed out, this makes up about 50% of all Fortinet firewall devices online.
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
Apple Patches 28 Security Flaws in macOS, iOS, and iPadOS
DoNot (APT-C-35) Targeting Bangladesh Military Personnel
McDonald’s, Vodafone Affected by Azure Theft Campaign Exposing Millions of Records
NIST to Modernize NVD in the Age of Artificial Intelligence
ALERT
Multiple TP-Link Flaws Allow to Bypass Auth and Escalate Privileges
LiteLLM supply chain attack reveals 153GB of stolen credentials online
PATCHCORD Backdoor Targets Telecom and CII In South Asia
Fortinet Fixes Multiple Flaws in FortiWeb, FortiManager, and FortiClient
“City-Forum” Campaign
“City-Forum” Campaign Attacks Salesforce and ServiceNow Instances Worldwide
Methodology & Unprecedented Scale
According to Diachenko’s investigative report, This campaign is run by a group of Russian-speaking cybercriminals from different companies. The scale of the operation is huge: the attackers made about 1.16 billion attempts to steal credentials from more than 320,000 FortiGate targets, plus an extra 2.1 billion brute-force attempts aimed at over 160,000 MSSQL servers.
The group’s methodology goes beyond simple credential reuse. They actively intercept SSL VPN authentication hashes and crack them using a massive, dedicated 45-GPU cluster managed via Hashtopolis. Once the perimeter is breached, the operators move quickly into the internal Active Directory to stay connected to the network.
Diachenko found that many organizations in Japan, Taiwan, Vietnam, Iraq, and Turkey were fully hacked. Most importantly, a Turkish NATO defense contractor was affected, and the group stole important defense papers from them.
Beaumont notes a sharp contrast between this incident and the prior “Belsen Group” leak of 15,000 devices from a 2022 zero-day. This dataset represents active, recent compromises—with many of the affected devices running recent patches.
Beaumont noticed that the way the leaked data is organized, which sorts victims by company type, income, and country, is typical of eCrime groups selling initial access on the dark web.
As Beaumont explains in his blog, the attackers likely exploited older credential hashing mechanisms to pull this off. While Fortinet hardened admin credential storage in early 2025 by moving to PBKDF2, this protection only applied if administrators actively logged in after applying the firmware updates. Consequently, many devices continued storing credentials using the older, more vulnerable SHA-256 with Salt format, making them highly susceptible to offline brute-forcing once the configuration files were extracted.
High-Profile Victims Identified
The impact of this breach affects almost all parts of the global economy and hits every industry. The attackers have created a real database with working login details for some of the biggest companies in the world.
Among the victims discovered in this dataset are massive multinational corporations, including:
Technology & Manufacturing: Foxconn, Samsung, Siemens, Lenovo, Oracle
Professional Services: PwC, Accenture
Telecommunications: Comcast
and thousands of government entities and critical infrastructure providers
“Lenovo said it was looking into it”, the register reported.
Mitigation Steps
Organizations using Fortinet devices must see this as a serious and active threat and take action right away:
Force Credential Rotation: Reset all Fortinet VPN and admin interface passwords without delay; complexity is irrelevant if credentials have already leaked.
Enforce Universal MFA: Apply Multi-Factor Authentication across all external gateways to neutralize stolen plaintext credentials.
Audit Gateway Logs: Review Fortinet access logs for anomalous login locations, unexpected admin sessions, or unusual traffic volumes.
Restrict Management Interface Exposure: Apply local-in policies to restrict admin panel access to trusted internal IPs only, and disable FortiCloud SSO if not essential.
“Fortinet is aware of a reported third-party credential-harvesting campaign targeting Fortinet firewalls and VPN gateways. We are committed to safeguarding our customers, and we diligently and continuously monitor threat actor darknet activity,” Fortinet told in a statement .
“Based on our analysis, the data involved is a resharing of data from previous incidents, as well as bruteforcing of credentials, and is not related to any recent incident or advisory. Organizations that follow routine best practices, including regularly refreshing security credentials, as per guidance in this March blog, face minimal risk from credential compromise detail referenced in the reporting.”
“Fortinet continues to investigate these reports with the security of our customers as our top priority.”
