Multiple reports say the ongoing FortiBleed campaign focuses on compromised Fortinet FortiGate devices, where attackers use custom malware to capture authentication data. Security firm SOCRadar reports that the campaign relies on a custom “sniffer” component designed to harvest authentication secrets from firewalls already under attacker influence. Dark Reading adds that researchers identified a Golang-based sniffer and estimates the campaign targets roughly 430,000 FortiGate firewalls, with visibility into potentially 110 million credentials.
Help Net Security describes organizations’ exposure as widespread and notes that researchers have reconstructed much of the attack chain using leaked attacker artifacts, including tools, scripts, and credentials found exposed on an Internet-facing server. The reporting indicates the operation is automated and can escalate impact from credential theft toward further network compromise, with claims that some victims may reach domain-level control.
Across outlets, the core activity centers on credential harvesting from FortiGate systems as part of a broader, persistent campaign, with researchers continuing to analyze the tools and scope based on collected telemetry and exposed materials.
