Arctic Wolf Labs published a technical teardown of a tool recovered during the investigation into FortiBleed, the campaign that harvested credentials from internet-facing Fortinet FortiGate firewalls and VPN gateways worldwide.
What the tool does
The recovered binary is a Go-based Linux tool branded “CyberStrike Harvester.” Per Arctic Wolf’s analysis it ingests packet captures (pcap, pcapng) and FortiGate text formats, then extracts credentials, NetNTLM and Kerberos hashes, cookies, tokens, sessions, email artifacts and SQL logins. Crucially, it emits attack-ready hash files, NetNTLMv2, Kerberos pre-auth, AS-REP and TGS output, so cracked material can be fed straight into the next stage.
From the edge to the domain
The teardown’s most useful contribution is showing the full path, not just the capture step. Arctic Wolf documents a repeatable workflow that converts perimeter credentials into internal-network exposure: VPN access, Active Directory enumeration, SMB authentication and file-share exfiltration. One recovered log recorded a single collection run of roughly 121 GB. Scope figures in Arctic Wolf’s data land in the tens of thousands of FortiGate entries across 194 countries.
Attribution signals
Russian-language interface strings and an operator handle observed in the code point to Russian-speaking operators, though Arctic Wolf stops short of a firm attribution.
Where CyberStrike comes up
The tool is branded around, and tied to, the open-source CyberStrike framework, released under AGPL-3.0. Like any dual-use security tool it can be run by defenders and researchers or, as this reporting documents, misused by a criminal operation.
Related coverage
- The Hacker News on FortiBleed and FortiGate
- SpyCloud maps the FortiBleed infrastructure
- SoCRadar’s ‘Dismantling FortiBleed’ report
- Cyber Security News profiles the CyberStrike platform
Source
- Arctic Wolf Labs, Inside FortiBleed: reverse-engineering the CyberStrike Harvester
