FortiBleed exposes credentials in transit and converts FortiGate to entry door for intruders

Socrates has published a report that expands research on the mass campaign known as "FortiBleed," and its most worrying finding is that the attackers did not just collect old credentials: they deployed custom snifers on FortiGate devices to capture secrets of in-transit authentication and produce large-scale exploitable credentials. According to the report, the operation would have affected hundreds of thousands of FortiGate devices since at least February 2026, which makes this incident an example of how a failure in the management of access and in the exposure of administrative consoles can become an initial access leg for specialized actors.

The central technique described in the report is the use of a tool in Go, baptized as FortigateSniffer, which is connected by SSH to the committed firewalls and runs the legitimate FortiOS diagnostic command "diagnose sniffer package." This abuse of an administrative function allows attackers to inspect traffic in real time to search for credentials and authentication materials for protocols such as RADIUS, NTLM, Kerberos, LDAP, SMTP, IMAP, databases, RDP and many others.

SOCRadar also documents a complete processing chain: the captured packages are rebuilt with a component called SNIFTRAN and are analyzed with a Python toolkit that extracts clear text credentials, hashes and Kerberos tickets. These artifacts are then prepared for brute force attacks offline and massive cracking with Hashcat in rented business GPUs. The hypothesis that the attackers even downloaded configuration files and extracted hashes is supported by independent research analysis; a technical summary of this update can be read on Kevin Beaumont's blog ( Kevin Beaumont) and in the Socrates report ( Dismantling FortiBleed - SOCRadar).

The profile of the adversary described above fits that of a initial access broker (IAB): actors who gain access and sell it in illicit markets, or who use it for subsequent intrusions and extortion. The combination of automated techniques of credental stuffing, brute force, the exfiltration of configurations and accelerated cracking using GPUs allows for the transformation of temporary access into reusable credentials and, therefore, persistent entry doors to corporate networks.

The complexity of the attack underlines a basic principle: a committed firewall is no longer just a barrier and becomes a privileged observatory. A FortiGate with administrative access can see and record sensitive traffic; if this device is controlled, the attacker gets visibility on credentials that many organizations continue to send in clear text or with vulnerable protocols. This makes identity infrastructure - Active Directory, RADIUS servers, databases, mail - immediate targets for lateral movement and privilege escalation.

For security teams and FortiGate administrators, the first priority is to investigate whether the inventory is among the known objectives. Kevin Beaumont published a list of IP addresses related to the campaign that can serve as a starting point for research ( list of IPs indicated). In addition, the evidence of execution of "diagnose sniffer package" and unauthorized SSH connections should be considered an immediate response commitment indicator.

In terms of practical mitigation, organizations must act on two fronts: immediate containment and structural hardening. In containment, you have to review the administrative accounts of the firewall, rotate credentials and keys, disable administrative access from the Internet when they are not necessary, review recent configuration files, restore from reliable backups if there is evidence of manipulation and activate multi-factor for administration access. In hardening, it is appropriate to limit the exposure of management services to internal networks or safe bastions, to encrypt authentication communications (LDAPs, TLS for services), to apply segmentation so that a committed device does not provide direct access to identity domenas, and to monitor administrative commands and package catches in firewalls.

Another relevant aspect that the campaign reveals is the use of GPU computer rented by attackers to decipher hashes on a scale: hiring 36 business GPUs allows you to crack passwords much faster than most internal security teams. This forces us to assume that any hash obtained could be broken in short time, so that the rotation of credentials and the restoration of secrets after a possible commitment must be carried out without delay. To understand the technology used for cracking and its technical limits, public sources such as the Hashcat project offer context on cracking capabilities ( Hashcat).

Finally, this incident should serve to strengthen a paradigm shift: it is not enough to protect perimetrally; it is necessary to design defenses where identities and access keys do not travel in clear and can not be collected from a single point of control. Implement access policies with less implicit confidence, apply MFA universally, audit and alert about changes in security settings, and practice incident response exercises with network infrastructure engagement scenarios are steps that reduce reward for actors seeking to exploit network devices like vectors.

If you administer FortiGate or manage identity in your organization, review SOCRadar's technical report, update independent researchers and list of published PIs, and consider activating a forensic response and informing affected parties: the window to prevent captured credentials from becoming persistent accesses is limited and proactive action can avoid more serious intrusions.