'FortiBleed' Campaign: Large-Scale Credential Attacks Targeting SSL-VPNs and Edge Devices

Summary

A large-scale credential theft and password-spraying campaign, internally tracked as "FortiBleed," is actively targeting internet-exposed security appliances and database services. The activity focuses on Fortinet and Sophos edge devices, as well as MSSQL instances. Threat actors are utilizing a curated list derived from previous breaches and successful exploits to gain initial access, subsequently extracting device configurations to expand their credential library and pivot deeper into target networks.

What happened

Threat actors are executing a multi-stage attack starting with massive, internet-wide password-spraying attempts. If initial access is achieved, the actors frequently attempt to escalate privileges—sometimes leveraging local vulnerabilities—to extract device configuration files. These files often contain stored credentials or hashes which the attackers then crack offline.

On June 16, 2026, an initial access broker (IAB) on the Russian-language forum Exploit[.]in claimed responsibility for the campaign, offering harvested credentials for sale and referencing an unspecified CVE. This cycle of automated spraying, configuration theft, and offline cracking allows the actors to move from a generic breach list to a highly specific and potent list of administrative credentials for corporate edge infrastructure.

Why it matters

This campaign is significant because it specifically targets the "keys to the kingdom": edge security devices. Compromising a firewall or VPN gateway allows attackers to bypass traditional perimeter security, intercept traffic, and potentially gain cleartext credentials for subsequent lateral movement. The use of a feedback loop—where credentials stolen from one victim are immediately used to spray others—increases the speed and success rate of the campaign.

Affected systems

• Fortinet Devices: Particularly FortiGate appliances with exposed management or VPN interfaces.
• Sophos Devices: Network security appliances exposed to the internet.
• MSSQL Servers: Specifically those with the default port (1433) exposed directly to the public internet.

Recommended actions

• Audit Authentication Logs: Monitor for high-volume login failures followed by a single successful login from the same or related IP address.
• Isolate Management Interfaces: Move administrative interfaces behind a "jump box" or Zero Trust Network Access (ZTNA) solution. These interfaces should never be directly accessible from the public internet.
• Enforce Phishing-Resistant MFA: Implement FIDO2/Passkey-based multi-factor authentication for all remote access points.
• Rotate Privileged Credentials: Immediately change default or long-standing administrative passwords on all edge devices. Use a Privileged Access Management (PAM) system to automate rotations.
• Patching: Ensure all edge devices are running the latest firmware to prevent the "Configuration Extraction" stage, which often relies on known local privilege escalation (LPE) vulnerabilities.