FortiBleed fallout: AI-powered credential heist exposes 110 million accounts in global firewall meltdown

By mid-2026, the FortiBleed campaign had compromised an alarming number of Fortinet FortiGate devices worldwide, with estimates ranging from approximately 74,000 to over 430,000 devices across more than 190 countries. This vast scale represents nearly half of all internet-facing Fortinet firewalls discoverable via Shodan, underscoring the unprecedented breadth of the breach that exposed over 110 million credentials, including those from major global enterprises such as Oracle, Comcast, Samsung, and critical infrastructure providers like NATO defense contractors.

The operational impact of FortiBleed is profound, as attackers leveraged a sophisticated 45-GPU cluster to crack passwords rapidly and harvest credentials at scale, enabling direct access to perimeter infrastructure without exploiting new vulnerabilities. This approach, combined with mass scanning techniques mirroring defender tools, allowed the campaign to automate credential harvesting across small and medium businesses as well as IT service providers, particularly in the United States and India, amplifying risks to enterprises and critical sectors globally.

FortiBleed's extensive credential compromise reveals a critical failure of traditional security measures, as many stolen passwords exceeded 25 characters and met complexity requirements yet were harvested directly from infostealer logs rather than cracked. This highlights a shift in cyber risk where industrial-scale exploitation of basic security weaknesses, such as poor password hashing and lack of multifactor authentication, enables attackers to bypass defenses and sell access widely on underground forums, exacerbating the threat landscape for organizations worldwide.

Victim organizations have reported unauthorized logins predominantly originating from Russian IP addresses during Moscow business hours, indicating a geographically focused and persistent threat actor. Fortinet and cybersecurity experts emphasize that organizations must assume any internet-facing Fortinet environment is targeted and urgently rotate administrative, VPN, and associated Active Directory credentials to mitigate ongoing risks, as the campaign’s scale and methodology continue to pose significant challenges to enterprise security.

Attackers orchestrated an industrial-scale campaign leveraging mass internet-wide scanning techniques that closely mirrored defender proof-of-concept tools, such as MassCan, to identify over 74,000 Fortinet devices across 194 countries. This reconnaissance was refined through multiple verification passes and device fingerprinting to confirm Fortinet FortiGate firewalls before launching credential brute forcing and spraying attacks using curated password lists derived from previous breaches. As Unit 42 analysts observed, the attackers exploited the common but risky practice of exposing management interfaces to the internet, enabling them to attempt billions of credential logins and successfully compromise roughly a third of targeted devices.

Credential harvesting formed the backbone of the FortiBleed campaign’s tradecraft, with attackers combining offline cracking of SHA-256 hashed passwords—powered by rented 40+ GPU clusters—with malware-based info stealers and password sniffers embedded on compromised devices. This approach allowed them to capture and reuse credentials across multiple Fortinet firewalls seamlessly, effectively creating a self-propagating attack chain that expanded their foothold without deploying additional malware. SpyCloud’s investigation highlighted how attackers lived off the land by exploiting built-in Fortinet commands to sniff network traffic, harvesting a broad spectrum of credentials beyond just Fortinet logins.

The campaign’s persistence hinged on sophisticated credential abuse tactics, including the exploitation of a backdoor account named 'admin3'—a non-default user account implanted by threat actors post-compromise via remote code execution vulnerabilities. This backdoor, combined with extensive password cracking and reuse of default or unchanged administrator credentials, underscored a glaring failure in basic security hygiene such as multifactor authentication. As one analyst remarked, 'A lot of it’s just like password stuff. It’s credential abuse, most of it. I mean, some cracking in there, too,' highlighting the attackers’ focus on exploiting weak authentication mechanisms to maintain long-term access.

FortiBleed represents a new era of AI-driven, automated cyberattacks that dramatically lower the skill barrier for attackers while scaling exploitation efforts to unprecedented levels. The operation was a coordinated, team-based effort involving dedicated infrastructure for password spraying, manual operator workstations, and AI-assisted malware development that sped up intrusion workflows. This shift to data-driven, high-volume attacks enabled the campaign to generate vast volumes of login attempts across hundreds of thousands of systems in parallel, reflecting a broader trend toward commodification of access as evidenced by the sale of harvested credentials on Russian-language cybercrime forums like Exploit[.]in.

Fortinet FortiGate devices running OS versions prior to 7.211, 74.8, and 76.1 relied on weak password hashing algorithms such as SHA-256, which are vulnerable to cracking with modest GPU resources. This vulnerability is exacerbated by the fact that even after upgrading to newer versions that implement the more secure PBKDF2 hashing, legacy SHA-256 hashes remain stored in full configuration backups until the first successful admin login post-upgrade wipes them out, leaving a window of exposure for all admin accounts.

The FortiBleed campaign exploited fundamental security oversights including the widespread exposure of Fortinet management interfaces to the internet, despite longstanding warnings against such practices. Attackers conducted mass sweeps for these exposed interfaces and leveraged malware-based info stealers and password sniffers to harvest credentials across multiple devices, enabling cascading compromises that were facilitated by poor credential hygiene and reuse—evidenced by the staggering 2.1 billion credentials tried against MSSQL and 1.6 billion against FortiGate targets, compromising roughly a third of 320,000 attempted devices.

The FortiBleed incident underscores a critical failure to adhere to fundamental security best practices, particularly the use of secure password hashing algorithms and multi-factor authentication. As security experts have noted, the lack of effective tools to discover and remediate weak password hashing implementations contributed to the vulnerability, while administrators are strongly urged to change all passwords and enable MFA to mitigate risks from leaked or weakly hashed credentials.

Compounding these issues is the accumulation of technical debt from delayed firmware updates, which leaves organizations playing catch-up to patch insecure password storage and other vulnerabilities. Design decisions such as retaining older password hashes for rollback purposes, while understandable, introduce inherent risks that attackers can exploit, highlighting the importance of incremental updates and proactive security hygiene to prevent large-scale exposures like those seen in the FortiBleed campaign.

Adopting Zero Trust identity management frameworks significantly strengthens defenses by enforcing strict access controls that limit administrative privileges and reduce attack surfaces. As highlighted in a June 2026 analysis, Zero Trust principles make unauthorized access much harder and noisier for attackers, increasing the likelihood of detection and making organizations less attractive targets compared to less protected peers. Palo Alto Networks further recommends leveraging jump boxes and Zero Trust Network Access (ZTNA) policies to ensure management interfaces are never exposed directly to the public internet, effectively narrowing the attack surface for configuration extraction.

Immediate and ongoing credential hygiene is critical to mitigating risks from FortiBleed and similar credential-based attacks. This includes the urgent rotation of all Fortinet administrative and SSL VPN credentials, enforcing phishing-resistant multi-factor authentication (MFA) on administrative accounts, and onboarding privileged accounts to Privileged Access Management (PAM) systems for automatic, timely password rotation. Palo Alto Networks emphasizes the necessity of strong MFA for all remote services, while continuous discovery and disabling of unused privileged accounts further reduce the attack surface and limit potential credential abuse.

Firmware updates and password hashing improvements are foundational to reducing technical debt and strengthening FortiGate security posture. Fortinet’s shift from SHA-256 to the more resilient PBKDF2 hashing algorithm in FortiOS versions 7.211, 74.8, and 76.1 represents a critical enhancement against password cracking. However, residual risks remain due to legacy SHA-256 hashes stored in configuration backups until cleared by a successful admin login, underscoring the importance of administrators changing all passwords post-upgrade. For devices no longer supported with updates, Fortinet advises complete replacement to avoid persistent vulnerabilities.

Complementing identity and firmware strategies, organizations must bolster supply chain and application security by auditing third-party integrations and OAuth permissions, as well as monitoring for unauthorized software installations. Regular reviews of supplier risk management programs for strategic vendors help close potential attack vectors exploited in large-scale campaigns like FortiBleed. Additionally, preparing for emerging identity technologies such as passkey migration within platforms like Google Workspace enhances future-proofing of access management.