The Hacker News covered FortiBleed, framing it as a financially motivated initial-access-broker operation rather than the exploitation of a new flaw, and that framing is the important part.
No zero-day required
According to the report, the operators did not burn a new vulnerability. They relied on reused credentials from earlier incidents, weak passwords and missing MFA, then deployed custom sniffers on compromised FortiGate firewalls to capture authentication data in transit. The campaign also extended beyond Fortinet to Synology NAS, Sophos firewalls, Citrix SSL-VPNs, RDWeb portals and MSSQL servers.
The numbers
The report cites a campaign active since February 2026 with a peak from May 31 to June 15, more than 430,000 FortiGate firewalls targeted, and over 659 credential-harvesting pipelines. Harvested totals run past 110 million credentials, including 14.8M RADIUS, 924K NTLM hashes, 130K Kerberos hashes and 89M MySQL tokens, with early validation cycles reported around 90% success.
Where CyberStrike comes up
The article attributes a “CyberStrike Harvester v1.5” tool to the operators, a Go-based parser handling authentication data across 24 protocols, and references the open-source CyberStrike framework, released under AGPL-3.0. Exact device and credential counts differ across the various reports, which is expected given each team’s vantage point.
Related coverage
- Arctic Wolf reverse-engineers the FortiBleed harvester
- SpyCloud maps the FortiBleed infrastructure
- SoCRadar’s ‘Dismantling FortiBleed’ report
- Cyber Security News profiles the CyberStrike platform
Source
- The Hacker News, FortiBleed targeted FortiGate firewalls
