InfoSecBulletin Cybersecurity for mankind
A vast cyber spying operation called “FortiBleed” has quietly compromised more than 73,932 different Fortinet firewall URLs in 194 countries.
Originally discovered by security researcher Volodymyr “Bob” Diachenko, with more study from Hudson Rock and cyber expert Kevin Beaumont, this dataset shows a huge, automated scheme. Bad actors managed to hit 73,932 different firewall URLs in 194 countries, leading to 21,632 unique affected domains. Shockingly, as Beaumont pointed out, this makes up about 50% of all Fortinet firewall devices online.
FortiBleed: 70,000 Fortinet Firewalls Compromised Globally
New Rokarolla Android malware hits 217 banking and crypto apps
Phishing Campaign Exploits Legitimate Microsoft Login Flow
ALERT
Cisco SD-WAN Zero-Day, FortiSandbox and cPanel flaws exploited in attacks
“Panthalassa” builds floating AI data centers powered by ocean waves
Critical Wazuh Vuln Enables Alert Tampering and Evidence Deletion
CVE-2026-0257
Palo Alto Warns of GlobalProtect VPN Vuln Actively Exploited
BD Gov.t to set up Tk192.66cr AI hub with support from Koica
Critical Splunk Enterprise Pre-Auth RCE Chain Exposes Databases With Zero Authentication
Anthropic disables Fable 5 and Mythos 5 Access after US order limiting foreign access
Methodology & Unprecedented Scale
According to Diachenko’s investigative report, This campaign is run by a group of Russian-speaking cybercriminals from different companies. The scale of the operation is huge: the attackers made about 1.16 billion attempts to steal credentials from more than 320,000 FortiGate targets, plus an extra 2.1 billion brute-force attempts aimed at over 160,000 MSSQL servers.
The group’s methodology goes beyond simple credential reuse. They actively intercept SSL VPN authentication hashes and crack them using a massive, dedicated 45-GPU cluster managed via Hashtopolis. Once the perimeter is breached, the operators move quickly into the internal Active Directory to stay connected to the network.
Diachenko found that many organizations in Japan, Taiwan, Vietnam, Iraq, and Turkey were fully hacked. Most importantly, a Turkish NATO defense contractor was affected, and the group stole important defense papers from them.
Beaumont notes a sharp contrast between this incident and the prior “Belsen Group” leak of 15,000 devices from a 2022 zero-day. This dataset represents active, recent compromises—with many of the affected devices running recent patches.
Beaumont noticed that the way the leaked data is organized, which sorts victims by company type, income, and country, is typical of eCrime groups selling initial access on the dark web.
As Beaumont explains in his blog, the attackers likely exploited older credential hashing mechanisms to pull this off. While Fortinet hardened admin credential storage in early 2025 by moving to PBKDF2, this protection only applied if administrators actively logged in after applying the firmware updates. Consequently, many devices continued storing credentials using the older, more vulnerable SHA-256 with Salt format, making them highly susceptible to offline brute-forcing once the configuration files were extracted.
High-Profile Victims Identified
The impact of this breach affects almost all parts of the global economy and hits every industry. The attackers have created a real database with working login details for some of the biggest companies in the world.
Among the victims discovered in this dataset are massive multinational corporations, including:
Technology & Manufacturing: Foxconn, Samsung, Siemens, Lenovo, Oracle
Professional Services: PwC, Accenture
Telecommunications: Comcast
and thousands of government entities and critical infrastructure providers
“Lenovo said it was looking into it”, the register reported.
Mitigation Steps
Organizations using Fortinet devices must see this as a serious and active threat and take action right away:
Force Credential Rotation: Reset all Fortinet VPN and admin interface passwords without delay; complexity is irrelevant if credentials have already leaked.
Enforce Universal MFA: Apply Multi-Factor Authentication across all external gateways to neutralize stolen plaintext credentials.
Audit Gateway Logs: Review Fortinet access logs for anomalous login locations, unexpected admin sessions, or unusual traffic volumes.
Restrict Management Interface Exposure: Apply local-in policies to restrict admin panel access to trusted internal IPs only, and disable FortiCloud SSO if not essential.
