FortiBleed

FortiBleed entered public view on 18 June 2026 when the UK NCSC and US CISA issued concurrent alerts after Ukrainian researcher Volodymyr Diachenko found a privately-held database of 86,644 Fortinet FortiGate firewall credentials spanning 194 countries. No zero-day was used. The operator harvested credentials from earlier Fortinet incidents and intercepted traffic on already-compromised devices, running the operation since at least February 2026, roughly four months before discovery. A 45-GPU cracking rig threw approximately 1.16 billion authentication attempts at 320,000 targets, indicating sustained, resourced infrastructure rather than a smash-and-grab.

What distinguishes FortiBleed is the metadata layered onto the credentials. The dataset logs organisation revenue bands, employee counts, and sector tags, the kind of profiling a ransomware crew would spend weeks building. Attribution points to a Russian-speaking group with NATO-weighted targeting, a posture analysts call intelligence preparation: acquire access quietly, hold it, and trigger it during a geopolitical window. Both agencies recommended factory-resetting affected FortiGate devices and rotating all credentials.

FortiBleed fits a pattern of edge-device exploitation that has become the dominant initial-access vector across this topic. Fortinet hardware had drawn CISA KEV entries in April 2026 for a separate SQL injection flaw. The operational model, credential harvest without exploit, is significant: it means the attacker's access survives Fortinet patching the underlying device vulnerabilities, because the logins themselves remain valid until individually rotated. For defenders, the lesson is that patching the device is necessary but not sufficient; credential rotation is the remediation the device patch cannot deliver.

SOCRadar confirmed in July 2026 that the harvest had crossed from a dormant hit list into live ransomware. The firm traced admin-level access to 409 targets and a completed attack chain on 354, with at least 12 confirmed ransomware deployments attributed to the INC Ransom and Lynx crews, who share code lineage and, SOCRadar found, one operator running both groups' negotiation panels. The scanning footprint reached roughly 11,250 FortiGate portals across more than 150 countries.