12OCT

86,644 Fortinet logins become a hit list

4 min read

10:55UTC

NCSC and CISA issued alerts on 18 June after a privately-held database of 86,644 FortiGate credentials across 194 countries surfaced. No zero-day was used.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Holding 86,644 profiled credentials privately signals careful targeting ahead, not a smash-and-grab.

The NCSC (the UK National Cyber Security Centre) and CISA both issued alerts on 18 June after a database of 86,644 Fortinet FortiGate firewall credentials, spanning 194 countries, surfaced in the criminal underground⁠¹. The attackers used no zero-day. The operation, dubbed FortiBleed, harvested credentials from earlier Fortinet incidents and intercepted traffic on already-compromised devices, running since at least February⁠². The discoverer, Ukrainian researcher Volodymyr Diachenko, dated his finding to 13 June⁠³.

What the dataset carries matters more than its scale. It logs organisation revenue bands, employee counts, and sector tags, the profiling a ransomware crew would otherwise spend weeks assembling, and it had not been dumped on any dark-web forum as of mid-June⁠⁴. A 45-GPU cracking rig threw roughly 1.16 billion authentication attempts at 320,000 targets⁠⁵. The revenue bands and sector tags give the operation away: an encryption crew does not need that metadata to lock files, but an intelligence operation needs it to prioritise. The attribution points to a Russian-speaking group with NATO-weighted targeting, and the decision to hold the data privately rather than sell it reads as preparation, not opportunism. That is the Volt Typhoon posture, the Chinese state-linked pre-positioning in US infrastructure: acquire access now, use it at a moment of the operator's choosing.

Edge devices keep opening the door. Check Point's VPN concentrator ran exploited for a month before its patch landed, and the FIRESTARTER Cisco implant survived every firewall patch thrown at it. The firewall is no longer only the way in; it is also the credential store. A leak with no exploit at all still earned two government alerts in a single day, because the harvested logins open the same doors a zero-day would, quietly and at national scale.

Deep Analysis

In plain English

Fortinet's FortiGate is one of the most widely deployed firewall appliances in the world, with tens of thousands of organisations relying on it to control access to their networks. In February 2026, someone began collecting the usernames and passwords used to log into 86,644 of these devices across 194 countries, without exploiting any known software flaw. They did it by reusing credentials leaked from other breaches and by intercepting network traffic. Researcher Volodymyr Diachenko found the database on 13 June. The detail is what makes it alarming: each entry includes the organisation's sector, revenue band, and employee count. That kind of profiling goes beyond what criminals need for a quick financial attack. It matches the preparation for a selective, targeted campaign, and the dataset skewed heavily towards NATO member countries.

Deep Analysis

Root Causes

Edge devices such as FortiGate firewalls and VPN concentrators carry structural credential-store vulnerabilities because their authentication architectures were designed for perimeter trust models that assumed internal networks were safe. When a device serves as both the authentication gateway and the credentials repository, a credential-reuse or traffic-interception attack bypasses authentication without exploiting any software flaw, leaving no CVE to patch.

Fortinet's credential plane went unmonitored for at least four months: the FortiBleed campaign ran since at least February 2026 without triggering vendor or customer detection. Neither Fortinet's telemetry nor most customers' monitoring extends to the credential-plane behaviour of their perimeter appliances.

The Check Point VPN exposure one month earlier followed the same pattern, with exploitation confirmed for a month before detection, confirming the credential layer of edge appliances as a systematic monitoring gap across multiple vendors.

What could happen next?

Risk
The 86,644 credentials in private hands since at least February 2026 may be activated selectively rather than en masse; organisations in NATO-member defence, energy, or finance sectors face elevated risk of targeted access attempts that the FortiBleed dataset would facilitate.
Immediate · Assessed
Consequence
Fortinet faces a third credential-incident disclosure in 36 months; institutional investors and enterprise procurement teams are likely to apply a systematic credential-hygiene surcharge to Fortinet devices in risk assessments and contract renewals.
Short term · Reported
Precedent
FortiBleed demonstrates that edge-device credential planes can be harvested at scale without any software vulnerability, creating a monitoring requirement that CVE patching alone cannot satisfy: behavioural analysis of authentication-plane traffic to and from perimeter appliances.
Medium term · Assessed

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2020 SolarWinds Orion compromise involved a nearly identical pre-positioning sequence: attackers collected network topology and credential data from thousands of targets for months before activating the destructive payload.

FortiBleed's private dataset, held without apparent monetisation since at least February 2026, matches that dormancy pattern. The SolarWinds attribution to SVR's Cozy Bear took six months; FortiBleed's Russian-speaking actor attribution rests on linguistic and targeting heuristics from a single commercial analysis.

Counter-parallel: The 2023 Volt Typhoon pre-positioning campaign in US critical infrastructure maintained access across 320+ organisations for up to five years without triggering any destructive payload. If FortiBleed follows that template, the expected use is selective disruption at a moment of geopolitical choice rather than immediate mass exploitation.

The counter-case is that Volt Typhoon used living-off-the-land techniques with no external credential database; FortiBleed's database discovery by a single researcher in June suggests less operational security than a mature state actor would maintain.

FortiGate appliances run across an estimated 750,000 enterprise deployments globally; the 86,644 credentials in the FortiBleed dataset represent roughly 11 per cent of that base. At the revenue-band granularity described by SOCRadar, a threat actor purchasing or activating this dataset could selectively target organisations by sector and size, enabling selective access-as-a-service pricing that the initial-access broker market has not previously achieved at this resolution.

For Fortinet, the market impact is incremental to a pattern: the company's stock fell 9 per cent in the 30 days following its October 2023 credential-leak disclosure and recovered within 60 days. Institutional investors now price recurring credential incidents into Fortinet's risk profile rather than treating them as isolated events.

Consensus view: SOCRadar's threat intelligence team assessed the FortiBleed dataset's sector and revenue banding as consistent with an intelligence-preparation-of-the-battlefield (IPB) pattern rather than ransomware target selection: ransomware crews do not need employee-count data, but a military or signals intelligence unit planning disruptive operations against specific economic sectors does. The NATO-weighted geographic distribution supports the same conclusion.

Counter-view: Recorded Future's Insikt Group argues the credential reuse and traffic interception methodology is more consistent with a financially motivated initial-access broker than a state actor: the 1.16 billion GPU-assisted authentication attempts across 320,000 targets describes a volume attack, not selective targeting. Insikt notes that a state actor conducting IPB would avoid the public exposure risk of a database discoverable by external researchers.

Key tension: Whether the private holding of the dataset, combined with the sector and revenue enrichment, represents pre-attack intelligence collection by a state actor or an unusually sophisticated access broker building a premium product for sale to multiple buyers.

Sources:NCSC·SOCRadar

Mentions:NCSC →CISA →Volt Typhoon →NATO →Orion →Check Point →FIRESTARTER →Cisco →SolarWinds →Fortinet →FortiBleed →SOCRadar →

First Reported In

Update #8 · CISA tears up the KEV deadline rulebook

NCSC· 24 Jun 2026

Read original →

Causes and effects

Caused by

VPN zero-day open a month pre-patch

Check Point's VPN concentrator running exploited for a month before patching establishes the edge-device credential-store pattern FortiBleed repeats.

Occurred 8 Jun 2026

Read story →

FIRESTARTER implant survives every Cisco firewall patch

FIRESTARTER demonstrating the firewall as a credential and persistence store contextualises FortiBleed's targeting of the same layer.

Occurred 24 Apr 2026

Read story →

This Event

86,644 Fortinet logins become a hit list

The dataset carries revenue bands and sector tags, the profiling a state-adjacent actor needs to pick targets at leisure rather than spray ransomware.

Led to

Lynx crew cashes in FortiBleed haul

The FortiBleed credential harvest privately flagged in June is now confirmed exploited by the Lynx/INC Ransom crew.

Occurred 1 Jul 2026

Read story →

One operator ran both ransomware brands

The 86,644 harvested Fortinet logins flagged in June became a working intrusion pipeline confirmed this window.

Occurred 8 Jul 2026

Read story →

CISA's KEV list runs a month late

FortiSandbox extends the Fortinet exposure thread that began with the FortiBleed credential haul.

Occurred 16 Jul 2026

Read story →

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.