SoCRadar’s Threat Research Unit (STRU) published Dismantling FortiBleed, a 77-page report that reconstructs the full attack chain behind the campaign targeting internet-facing Fortinet FortiGate firewalls. It is the most detailed public account of the operation so far.
The scale
STRU puts more than 430,000 FortiGate firewalls in scope, with 80,553 identified targets and roughly 19,000 devices still being actively sniffed at the time of writing. Across 659 harvest cycles run between May 31 and June 15, 2026, the operators aggregated 110 million+ credentials, including 14.8M RADIUS records, 924K NTLM hashes, 130K Kerberos hashes and 89M MySQL tokens.
The attack chain
The report traces a multi-phase workflow: credential sourcing and reconnaissance, pairing and initial access, sniffer deployment, exploitation of cracked material, and exfiltration. The core tool is FortigateSniffer, a Go binary that abuses the built-in FortiOS diagnose sniffer packet command to passively capture authentication traffic across 24 protocols, alongside credential checkers for FortiGate, MSSQL and Synology. The campaign has run since at least February 2026 and remains active.
Who was hit
Targeting skews heavily toward small and mid-sized businesses under 200 employees, concentrated in the United States and India, with IT services a key sector likely chosen to reach downstream customers. STRU attributes the operation to a financially motivated initial access broker, notes Cyrillic comments in the tooling, and flags one high-value victim: a NATO-aligned defense contractor whose DFS backup data was exfiltrated on June 15 after offline Kerberos cracking.
Where CyberStrike comes up
STRU reports that parts of the workflow “may have been assisted by” CyberStrike, an open-source, AI-powered autonomous pentesting agent, and that a CyberStrike agent was auto-provisioned across the operators’ lab of seven Kali VMs as the primary payload. CyberStrike is open source under AGPL-3.0; like any dual-use offensive tool it can be run by defenders and researchers or, as this report documents, misused by a criminal crew.
What SoCRadar recommends
For exposed organizations, the report’s guidance is direct: rotate all Fortinet VPN and admin credentials, enforce MFA, take FortiGate management interfaces off the public internet, and review gateway and authentication logs. SoCRadar also published a FortiBleed exposure checker and notified affected customers and CERTs. The report ships with MITRE ATT&CK mappings and indicators of compromise.
Related coverage
- Arctic Wolf reverse-engineers the FortiBleed harvester
- The Hacker News on FortiBleed and FortiGate
- SpyCloud maps the FortiBleed infrastructure
- Cyber Security News profiles the CyberStrike platform
Source
- SoCRadar Threat Research Unit, Dismantling FortiBleed (PDF)
