Last updated on 19 June.

A dataset containing valid administrative and VPN credentials for tens of thousands of Fortinet FortiGate firewalls has been attributed to a Russian-speaking threat group, with confirmed impacts across government, critical infrastructure, and multinational corporations. Organizations should verify exposure immediately and rotate credentials.

What's Happening

On June 13, 2026, security researcher Volodymyr "Bob" Diachenko reported on the "FortiBleed" dataset, which allegedly contains valid administrative and SSL VPN credentials for approximately 73,932 FortiGate firewall URLs across 194 countries and more than 21,600 domains. Diachenko attributed the campaign to a Russian-speaking threat group.

Cybersecurity researcher Kevin Beaumont and threat intelligence firm Hudson Rock subsequently validated portions of the dataset. Beaumont confirmed that sampled administrative credentials were authentic. Many affected devices reportedly remained online at the time of disclosure, ran recent FortiOS versions, and had management interfaces exposed to the internet.

Affected organizations span government, telecommunications, financial services, healthcare, manufacturing, and critical infrastructure sectors, including multinational corporations.

How the Attack Was Executed

According to Diachenko's investigation, threat actors:

• Conducted approximately 1.16 billion credential attempts against 320,777 FortiGate targets
• Conducted approximately 2.1 billion credential attempts against 163,650 Microsoft SQL Server (MSSQL) systems
• Intercepted SSL VPN authentication hashes
• Used a 45-GPU cluster managed through Hashtopolis to crack hashes and recover plaintext credentials
• Accessed internal Active Directory environments using recovered credentials

Researchers assessed that the dataset likely originated from exported FortiGate configuration files, which enabled offline credential recovery without ongoing access to the targeted devices.

Scale and Impact

The FortiBleed dataset covers organizations in 194 countries. Confirmed or reported compromises include organizations in Japan, Taiwan, Vietnam, Iraq, and Türkiye. Among those affected is a Turkish NATO defense contractor from which threat actors allegedly exfiltrated classified documents.

Why This Matters

Several factors make FortiBleed a high-priority incident:

• A subset of credentials have been independently verified as authentic
• Affected devices in many cases remain online with no indication of remediation
• The campaign's scale (73,932 firewall URLs, 194 countries) makes this one of the largest confirmed FortiGate credential exposures on record
• Attribution to a Russian-speaking threat group, combined with confirmed targeting of a NATO defense contractor, raises the likelihood of espionage objectives alongside opportunistic access
• The offline cracking methodology means organizations may have no logs of the initial credential theft

Timeline of Events

• June 13, 2026: Researcher Volodymyr Diachenko publicly reports the FortiBleed dataset and attributes activity to a Russian-speaking threat group
• June 13, 2026: Kevin Beaumont publishes analysis confirming sampled credentials are authentic; notes many affected devices remain online and internet-exposed
• June 13, 2026: Hudson Rock validates portions of the dataset and releases a free FortiBleed lookup tool for organizations to check domain exposure

Recorded Future Independent Analysis

Insikt Group analysts identified malicious activity originating from the IP address 85[.]11[.]187[.]8, which is linked to the FortiBleed attacks, during internal analysis and associated it with AS211486 within the 85[.]11[.]187[.]0/24 range. Analysts observed HTTP activity on port 9999 on June 7, 2026, and SSH, VNC, RDP, and additional attack-capture-related activity from June 14 to June 15, 2026.

Artifacts identified on this infrastructure were consistent with a full credential harvesting and follow-on intrusion workflow, including:

• A sniffer log associated with Fortinet credential capture (fg_capture.log);
• Cracking orchestration files tied to Hashcat, Hashtopolis, and Telegram-coordinated tasking (bot.py, hashpanel.log, setup_hashcat.sh, and setup_hashtopolis.sh;
• Active Directory and LDAP enumeration scripts (ad_enum.py and ad_full_audit.py);
• Password-spraying tooling (spray_*.sh, spray_*.py, and spray_results.txt);
• SMB/DFS collection scripts with staged exfiltration capability backup_dfs.py, backup_dfs2.py, spider.py, and smb_test.py); and
• Log-clearing markers were also present, indicating efforts to remove evidence of activity.

A June 18, 2026 PwnDefend blog post corroborated these findings by independently identifying 85[.]11[.]187[.]8 as a source IP associated with the FortiBleed campaign. The overlap between Insikt Group's internal findings and subsequent public reporting increases confidence in this IP's association with FortiBleed-related credential harvesting, cracking, and follow-on network access activity.

What You Need to Do Now

Immediate actions if your organization runs Fortinet:

• Rotate all FortiGate admin and SSL VPN credentials immediately
• Enforce multi-factor authentication on all remote and administrative access
• Review Fortinet logs for unusual logins, admin sessions, config changes, and new accounts. Consider replacing devices that have had suspicious activity.
• Restrict or remove internet exposure for management interfaces
• Patch FortiOS and review hardening settings
• Hunt for downstream compromise inside the network if exposed credentials were in use

Recorded Future customers with affected domains will receive automated credential alerts if their organization is in the dataset as sources are ingested into the Platform. Customers can find the main source in the platform as FortiBleed URL, Login, Password (ULP) Credential Leak.

Recorded Future customers can access the full Analyst Note and FortiBleed Intelligence Card in the Recorded Future Portal for additional indicators, affected organization context, and threat actor attribution detail.

Learn how to stay ahead of emerging threats. Understand all of the critical vulnerabilities that may be affecting your organization. Speak to our threat intelligence experts today.