FortiBleed campaign used custom FortiGate sniffer to steal credentials

FortiBleed Campaign Revisited: FortigateSniffer and the Harvesting of Credentials

IntroductionA broad campaign targeting Fortinet FortiGate firewalls has been studied in depth by security researchers. The operation, described as FortiBleed, employs a custom toolchain to harvest authentication secrets from compromised devices and to steal credentials from vast amounts of network traffic. The findings outline how an initial access broker leveraged credential stuffing and brute-force techniques to gain footholds, then deployed a dedicated sniffing framework on affected FortiGate appliances to capture sensitive data traversing the network.

Campaign At a Glance

• Scope: Targeted more than 430,000 FortiGate firewalls worldwide.
• Timeline: Active since at least February 2026.
• Victims: Associated with more than 80,000 Fortinet VPN credentials exposed by the broader campaign.
• Primary actors: An initial access broker (IAB) responsible for gaining entry, followed by credential harvesting and offline password cracking operations.
• Objective: Access corporate networks, exfiltrate credentials, and enable further exploitation via compromised devices.

Key Components and How They Work

• FortigateSniffer: A Golang-based tool used to monitor and extract authentication data from traffic passing through compromised FortiGate devices.
• Activation: Installed after gaining administrative access through credential stuffing and brute-force techniques.
• Operation: Connects to FortiGate devices via SSH and executes the FortiOS diagnose sniffer packet command to capture traffic in real time.
• Diagnose Sniffer Packet: A built-in FortiOS diagnostic command that administrators use to diagnose connectivity, authentication, and network performance.
• Coverage: Configured to observe authentication protocols and remote access services, including Kerberos, LDAP, RADIUS, SMB, RDP, WinRM, and others.
• Data Flow and Reconstruction: Sniffer output is gathered by a component named SnifTRAN, which reconstructs captured traffic into PCAP files for analysis.
• Analysis Toolkit: A Python-based PCAP Deep Analysis Toolkit processes the captured PCAPs to reveal credentials and related artifacts.
• Outputs: Cleartext credentials, password hashes, Kerberos tickets, NTLM authentication materials, as well as credentials for SMTP, IMAP, MySQL, PostgreSQL, and RADIUS when present.
• Hash Cracking: The toolkit prepares files containing NTLM and Kerberos hashes for cracking and then leverages a GPU-based Hashcat setup.
• Infrastructure: Operated on a distributed GPU cluster, including 36 enterprise-class GPUs, to crack hashed credentials at scale.
• FortiGate Configuration Files: In addition to live traffic, attackers reportedly downloaded FortiGate configuration files from compromised devices to obtain hashed credentials and related data.
• Rationale: Config files can contain serialized credentials or session-related secrets that facilitate access across systems.
• Credential Harvesting Pipeline: Collected data is transformed into Hashcat-ready formats and used to crack passwords and extract usable credentials for unauthorized access.

The Toolchain in Action: Step-by-Step (High-Level)

• Initial Access: Attackers employ credential stuffing and brute-force methods to gain admin access to FortiGate devices.
• Deployment: The FortigateSniffer framework is installed on compromised devices.
• Traffic Logging: The diagnose sniffer packet command is used to monitor and capture authentication-related traffic across multiple protocols.
• Data Extraction: SnifTRAN reconstructs captured traffic into PCAP files for deeper parsing.
• Credential Discovery: The Python toolkit extracts cleartext credentials, hashes, Kerberos tickets, NTLM materials, and other authentication artifacts.
• Hash Cracking: Hashcat, running on a GPU cluster, attempts to crack collected hashes to reveal plaintext credentials.
• Credential Harvest: Cracked credentials and other sensitive data are then used to facilitate unauthorized access to networks.

Evidence, Observations, and Updates

• SOCRadar Findings: The security firm SOCRadar documents the FortiBleed operation as an ongoing, large-scale campaign that continues to compromise FortiGate VPN devices, with an emphasis on credential harvesting from network traffic.
• Fortinet Reply: Fortinet characterized the event as a collection of previously compromised credentials rather than a newly disclosed vulnerability or incident. The ongoing activity, however, suggests active exploitation of FortiGate devices by credential-stuffed and brute-forced access, followed by credential harvesting on affected systems.
• Independent Insight: Analysts highlighted the use of legitimate FortiOS features as attack vectors, notably the diagnose sniffer packet capability, repurposed to surveil and extract authentication data from traffic traversing the firewall.
• Publicly Shared Indicators: Researchers and journalists have circulated IP address lists associated with victim organizations to help defenders review potential exposure. The nature of the campaign makes the replacement of credentials or the hardening of configurations essential to incident response.

Technical Details and Artifacts

• Protocol Coverage: The sniffer targeted a broad set of authentication mechanisms, including Kerberos, LDAP, NTLM, RADIUS, SMB, RDP, WinRM, SMTP, IMAP, POP3, MySQL, PostgreSQL, and more.
• Data Types Captured: Cleartext passwords, password hashes, Kerberos tickets, NTLM materials, email credentials, database credentials, and other authentication artifacts discovered within network flows.
• Processing Pipeline: PCAP data were transformed into readable artifacts and then formatted into hashing-ready files for cracking, enabling attackers to attempt password recovery at scale.
• Infrastructure for Cracking: A distributed GPU cluster, including 36 enterprise GPUs, reportedly hosted cracking workloads for these credentials. An additional note suggested that some cracked credentials were obtained by downloading FortiGate configuration data from compromised devices.

Scope of Impact and Implications

• Widespread Exposure: With tens of thousands of FortiGate devices affected and a substantial collection of VPN credentials exposed, the campaign underscores the risk of credential reuse and the value of stolen credentials for lateral movement within organizations.
• Attack Model Evolution: The FortiBleed operation illustrates a multi-stage attack chain, starting from external credential stuffing and brute-force entry, then leveraging legitimate device capabilities to harvest credentials from internal traffic.
• Ongoing Threat: The combination of credential harvesting, offline cracking, and configuration data exfiltration points to a persistent threat landscape where attackers continue to monetize already-compromised credentials.

Context and Related Developments

• The FortiBleed phenomenon echoes earlier disclosures about credential theft and VPN exposure, highlighting the importance of monitoring and alerting for unusual activity around network devices and privileged accounts.
• Independent researchers have produced public analyses and follow-up updates, including lists of targeted IP ranges and observations about how GPUs are used to accelerate password cracking in enterprise contexts.

Notes on Official Statements and Discrepancies

• While security researchers describe FortiBleed as an ongoing campaign with active compromise of FortiGate VPN devices, vendor messaging has framed the event as involving credentials that were previously compromised rather than indicating a new vulnerability.
• The evolving narrative emphasizes the need for organizations to review active credentials and monitor for anomalous activity related to FortiGate devices, particularly for those that may have experienced credential stuffing or brute-force attempts.

Related Coverage and Context

• FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices.
• CISA cautions Fortinet users to secure devices after FortiBleed exposure.
• Broader discussions on the market for stolen credentials and the mechanics of credential compromise in enterprise environments.
• Additional Fortigate-related security concerns and defenses discussed in contemporaneous reporting.

Closing ThoughtsFortiBleed serves as a striking example of how legitimate device features, when abused, can enable sophisticated credential harvesting at scale. The campaign combines multiple attack surfaces—from external credential stuffing to internal traffic surveillance—creating a persistent risk to organizations relying on Fortinet FortiGate appliances. The ongoing evolution of this threat underscores the importance of thorough monitoring of privileged access, careful review of credential integrity, and awareness of how compromised configurations can feed back into credential exposure in complex enterprise networks.

Related Coverage

• FortiBleed: Fortinet VPN credentials exposed for thousands of devices.
• Security advisories and analyses detailing credential harvesting and brute-force techniques.
• Explorations of the market dynamics surrounding stolen credentials and initial access brokers.