A Russian-speaking initial access broker (IAB) motivated by financial gain is assessed to be behind a large-scale credential-harvesting operation dubbed FortiBleed. The campaign has targeted over 430,000 FortiGate firewalls globally, according to a report from The Hacker News.
The campaign has been active since February 2026, involving the collection of credential lists, scanning for exposed services, and brute-forcing accessible systems. While a specific CVE is not mentioned in the report, the operation represents a significant threat to network security.
The attackers are deploying bespoke tools as part of their exploit mechanism, focusing on harvesting credentials from compromised firewalls. Indicators of compromise likely include unusual login attempts and traffic from unknown IP addresses, though specific IOCs were not detailed in the report.
As of the report's publication, no specific patches or workarounds have been identified for FortiBleed, as the attack relies on credential harvesting rather than a specific software vulnerability. Organizations are advised to enforce strong authentication controls and monitor firewall access logs for suspicious activity.
Attribution points to a Russian-speaking IAB acting for financial gain, highlighting the persistent threat from initial access brokers in the cybersecurity landscape. The scale of this operation underscores the ongoing risk to widely deployed network appliances like FortiGate firewalls.