JADEPUFFER: the first agentic ransomware
JADEPUFFER: the first agentic ransomware
External Attack Surface Management: reducing your external exposure
External Attack Surface Management: reducing your external exposure
Stay ahead of threats to your industry with real-time intelligence.
Stay ahead of threats to your industry with real-time intelligence.
Your executives are targets. Monitor your leadership's digital exposure.
Your executives are targets. Monitor your leadership's digital exposure.
Threat News
3 min read
FortiBleed: tens of thousands of Fortinet firewalls compromised without a single zero-day
safe-e Intelligence Team
Cyber Threat Intelligence
Between 30,000 and 75,000 FortiGate devices across 194 countries, with no new flaw. Just reused passwords, default accounts and SSL VPN hashes cracked offline. Most are still online.
The campaign is active right now, as you read this article.
No new vulnerability. No zero-day. What compromised between 30,000 and 75,000 FortiGate firewalls across 194 countries was far simpler: reused passwords, administrative accounts left with factory-default names, and SSL VPN authentication hashes cracked offline. The "FortiBleed" campaign is a direct reminder that a perimeter does not guarantee security when the credentials protecting it already circulate in infostealer databases. The vast majority of compromised devices remain online and active. The attacker still has access.
What happened
Researcher Volodymyr Diachenko identified an exposed operational server belonging to a threat group, containing automation tools and a validated Fortinet credentials database. Hudson Rock and SOCRadar analyzed the data independently. The numbers differ (30,791 devices vs. more than 73,000 unique URLs), but the diagnosis is the same: industrial scale, working credentials, and an ongoing operation.
Among the identified domains: Foxconn, Samsung, Siemens, Oracle, PwC, Comcast, Chevron, AT&T, Toyota, and hundreds of government entities. Presence in the dataset indicates validated credentials for that domain. It is not a confirmed breach declaration by each organization, but it is not a false alarm either.
Cases of full network compromise were documented in Japan, Taiwan, Vietnam, Iraq, and Turkey. The Turkish case points to a NATO-affiliated defense contractor, with allegations of classified document exfiltration. That specific allegation is still awaiting independent confirmation.
How the chain works
The operation is automated and self-reinforcing. Each compromised device feeds the cycle with new credentials:
Scanning FortiGate instances exposed to the internet (port 443 and variants: 4443, 8443, 10443).
Credential stuffing using passwords from prior leaks and infostealer collections.
Capturing SSL VPN authentication hashes for offline cracking on a 45-GPU cluster via Hashtopolis.
Automatic validation of each credential before entry: only working credentials are included.
Lateral movement to Active Directory in deeper compromises.
Using the compromised device as a listening point to capture credentials in transit and feed them back into the scanning engine.
Why complex passwords didn’t help
A significant portion of the compromised credentials included passwords up to 20 characters long. Complexity does not protect a password already collected by an infostealer and circulating in plaintext in underground databases.
Critical technical detail: Fortinet migrated to the PBKDF2 algorithm for administrative credential storage in early 2025. That protection only applies to devices whose administrators logged in after applying the firmware update. Devices without that subsequent login continued storing credentials in SHA-256 with salt, far more vulnerable to offline cracking. The firewall was updated. The credential was not.
What to do now: complete mitigation recommendations
Execute this checklist immediately. Do not wait for confirmation of presence in the datasets.
Rotate all credentials now. Reset passwords for all administrative and SSL VPN accounts on Fortinet devices. Prior password complexity is irrelevant if the password has already been leaked.
Enable mandatory MFA on all externally exposed management and remote access interfaces, without exception.
Audit and rename default accounts. Variations of the "admin" username represent more than one third of all dataset entries. Rename or disable all generic administrative accounts and native Fortinet system accounts.
Restrict management panel access. Apply local-in policies to limit management interface access exclusively to trusted internal IPs. Disable FortiCloud SSO when not strictly necessary.
Update firmware and log in after the update. Migration of credentials to PBKDF2 only occurs with an administrative login following the firmware update. Without that login, an updated device still stores credentials in the vulnerable format.
Review access and VPN logs for anomalous login locations, unexpected administrative sessions, off-hours access, and unusual traffic volumes.
Check domain exposure using both free tools available. Hudson Rock published a domain lookup portal for direct verification against the campaign dataset. SOCRadar offers the Free Dark Web Report for scanning dark web, infostealer logs, and leaked credential bases. Use both: the datasets have partially distinct coverage.
Engage your incident response team immediately if your organization’s domain is identified in either dataset. Treat a positive result as evidence of unauthorized access already achieved, not a theoretical risk. Do not wait for further confirmation before initiating response.
Conclusion
FortiBleed required no new technical discovery. It required automation, old credentials, and a target list any port scanner can generate.
The attacker already has access. The question is how long they will keep it.