FortiBleed: a firewall packet capture turned into a credential harvester

The campaign SOCRadar calls FortiBleed used a Go tool named FortigateSniffer, which does not exploit anything. It drives FortiOS's built-in packet-capture feature on firewalls the attacker already administers, watching traffic across 24 protocols and pulling out cleartext passwords, NTLM and Kerberos hashes, email and database logins, and authentication material from RADIUS, LDAP, SMB, RDP, WinRM, and SQL.

Access came from an initial access broker using credential stuffing, brute force, credential harvesting, and offline password cracking to reach administrative accounts. There was no Fortinet vulnerability. SOCRadar reports targeting across more than 430,000 FortiGate firewalls, with credentials exposed on roughly 80,000 devices, active since at least February 2026.

Why it matters

A firewall sees authentication traffic for everything behind it, which makes firewall admin access a credential-harvesting position rather than a networking one. The blast radius is not the device, it is every account whose authentication crossed it.

Two things follow. First, this began with credential stuffing against management interfaces, so infrastructure admin accounts need the phishing-resistant MFA you have been rolling out to users, and management planes should not be reachable from the internet at all. Second, remediation is larger than it looks: if a firewall in the path was compromised, resetting the firewall's own credentials is not enough. Every credential that traversed it should be considered exposed, including service accounts and anything that authenticated over LDAP or SMB. SOCRadar published targeted IP addresses, which is the cheapest way to size your exposure.

Source: BleepingComputer