FortiBleed Campaign Targets Firewalls Worldwide - 18th June 2026

Affected Environment

Fortinet FortiGate firewalls and VPN appliances with management interfaces exposed to the internet, particularly those using default, reused, or previously leaked credentials. Affected sectors include government, telecommunications, healthcare, and critical infrastructure globally.

Threat Overview

A large-scale threat campaign dubbed FortiBleed is targeting Fortinet FortiGate firewalls and VPN appliances. Unlike traditional vulnerability exploitation, this campaign is characterized by automated, large-scale credential abuse. Threat actors use previously leaked, reused, or default credentials to systematically scan for internet-exposed Fortinet management interfaces and attempt authentication at scale. Upon successful login, attackers gain legitimate administrative access and can operate undetected within trusted network boundaries.

Exposure Timeline

Campaign reported 18 June 2026. Operation already confirmed to have impacted tens of thousands of devices across hundreds of countries. Victim organizations include major global enterprises. Hudson Rock launched a free lookup portal for organizations to check whether their domains appear in the compromised dataset.

Attack Surface

Any internet-exposed Fortinet management interface using credentials that appear in leaked credential databases, are set to defaults, or have been reused across services. The campaign uses automated scanning infrastructure supported by centralized databases of tens of thousands of verified working credentials.

Technical Root Cause

This is not a software vulnerability exploitation campaign. The root cause is credential hygiene failure: use of default credentials, credential reuse across services, and the presence of Fortinet management interfaces exposed directly to the public internet. Once attackers authenticate with valid credentials, they operate with full administrative legitimacy, making detection through traditional signature-based controls difficult.

Post-authentication capabilities observed include monitoring and intercepting network traffic through the firewall, capturing additional credentials including VPN and user authentication data, extracting sensitive configuration data such as firewall rules, network topology, and VPN settings, and establishing persistent access for long-term operations.

Exploitation Pathway

Automated tooling scans for internet-exposed Fortinet management interfaces, then attempts authentication using credential databases sourced from prior breaches and leaked data. On successful login, attackers conduct reconnaissance and credential harvesting silently. Deeper compromises observed in Japan, Taiwan, Vietnam, Iraq, and Turkey, including a NATO defense contractor where classified documents were allegedly stolen. Reported victim organizations include Samsung, Oracle, Foxconn, Comcast, Siemens, Lenovo, Spotify, and Sony.