FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation

A Russian-speaking threat actor, dubbed FortiBleed, is conducting a large-scale credential harvesting operation targeting over 430,000 FortiGate firewalls globally. The campaign, active since February 2026, utilizes a Golang-based tool, FortigateSniffer, to passively capture authentication traffic and then cracks the resulting credentials for use in attacks against Active Directory domains and other services. The operation has resulted in the identification of over 110 million credentials, primarily targeting SMBs in the United States and India, and involves a multi-vendor approach including Synology NAS and Sophos firewalls.