SpyCloud published an analysis of the infrastructure behind FortiBleed, and its headline finding is that the FortiGate dataset was just one piece of a much larger initial-access-broker operation.
One operation, many targets
SpyCloud reports the operators ran three main servers and went well beyond Fortinet. Alongside 73,932 FortiGate credentials across 21,632 domains in 194 countries, drawn from 1.17 billion host and credential combinations tested, they also scanned 336,583 Synology NAS portals, 247,584 Sophos firewall portals and 163,650 MSSQL servers (the latter via 2.1 billion login attempts). From that funnel, roughly 22,000 validated targets were sorted by revenue and industry for follow-up.
A documented breach
SpyCloud ties the operation to a concrete loss: around 105 GB of data exfiltrated from a Turkish defense contractor. Its reconstructed timeline runs from brute-forcing beginning May 19 (the same day the operators spun up a Cursor AI coding account), cracking infrastructure on May 31, hands-on intrusion from June 7, and data enrichment and cash-out preparation from June 13.
Where CyberStrike comes up
SpyCloud describes the operators using CyberStrike, which it characterizes as an AI-powered penetration-testing framework, to automate intrusions and lower the skill needed to run agentic assessments at scale. CyberStrike is open source under AGPL-3.0; the reporting documents its misuse, not an endorsement.
Related coverage
- Arctic Wolf reverse-engineers the FortiBleed harvester
- The Hacker News on FortiBleed and FortiGate
- SoCRadar’s ‘Dismantling FortiBleed’ report
- Cyber Security News profiles the CyberStrike platform
