# FortiGate Mass Compromise: 110 Million Stolen Credentials Fuel Ransomware Assault
The recently exposed FortiBleed campaign represents one of the largest credential-harvesting operations targeting network infrastructure, with confirmed links to INC Ransom and Lynx ransomware groups now actively weaponizing stolen access. Security researchers at SOCRadar have connected the dots between a sprawling credential theft operation and concrete ransomware deployments, turning what initially appeared to be opportunistic scanning into a coordinated, infrastructure-focused attack pipeline.
## The Threat
FortiBleed emerged last month when an operational security failure exposed a server containing stolen credentials from thousands of Fortinet appliances. What researchers discovered behind that initial breach was far more alarming: a sophisticated, multi-stage campaign systematically targeting exposed Fortinet FortiGate firewalls worldwide.
The threat actors began with large-scale internet scanning to identify exposed FortiGate management interfaces across 150+ countries. Once identified, they deployed credential-guessing attacks using common username and password combinations—a tactic that proved devastatingly effective against improperly configured or unpatched systems. Upon gaining initial access, attackers installed a custom Golang-based packet sniffer designed to passively monitor network traffic and harvest credentials, session tokens, and authentication data in real time. This multi-layered approach yielded approximately 110 million stolen credentials from an estimated 430,000 FortiGate firewalls globally.
What makes FortiBleed particularly dangerous is the verified connection between credential theft and actual ransomware deployment. SOCRadar's investigation uncovered that operators with access to FortiBleed's stolen credentials were simultaneously logged into negotiation panels for both INC Ransom and Lynx ransomware groups, with victim overlaps confirming that stolen credentials directly facilitated follow-on intrusions and encryption attacks.
## Severity and Impact
| Attribute | Details |
|-----------|---------|
| Primary CVE | CVE-2026-35616 (FortiClient EMS exploitation observed) |
| CVSS Score | 9.1 (Critical) |
| Affected Components | FortiGate firewalls (credential theft via packet sniffing); FortiClient EMS (RCE vector) |
| Attack Vector | Network / Unauthenticated scanning → Authenticated credential theft |
| Attack Complexity | Low (credential guessing; packet sniffing requires only network presence) |
| Authentication Required | No (initial scanning); Yes (credential theft requires prior admin access) |
| Scope of Compromise | 409 confirmed admin-level breaches; 354 full attack chain completions; 12+ ransomware deployments verified |
The scale is unprecedented for a single campaign: over 11,250 FortiGate portals scanned, nearly 410 successfully compromised at administrative level, and at least 354 organizations subjected to the complete attack lifecycle. The downstream impact includes 12 verified ransomware deployments affecting hundreds of encrypted endpoints across victim organizations.
## Affected Products
Fortinet Products:
Third-Party Software:
Targeted Sectors:
Manufacturing, technology, logistics, energy, utilities, and waste management organizations in Latin America and Asia-Pacific regions bear the highest documented risk, though the campaign's global scanning footprint suggests exposure across all sectors and geographies.
## Mitigations
Immediate Actions:
1. Credential Rotation: Reset all admin and service account passwords on FortiGate appliances immediately. Assume any credentials generated before June 2026 may have been harvested by FortiBleed.
2. Access Review: Audit admin-level access logs on FortiGate devices for suspicious login patterns, concurrent sessions, or access from unexpected geographies.
3. Patch FortiClient EMS: Apply security updates for CVE-2026-35616 to all FortiClient EMS deployments to prevent exploitation as a secondary attack vector.
Network-Level Defenses:
4. Restrict Management Access: Disable internet-facing FortiGate management interfaces. Use VPN, jump hosts, or private management networks for administrative access.
5. Monitor for Packet Sniffers: Search FortiGate logs for signs of custom packet-sniffing processes. Enable egress monitoring to detect exfiltration of credentials or session data.
6. Segment Critical Assets: Isolate manufacturing, logistics, and technology infrastructure from general network segments to limit ransomware lateral movement if breach occurs.
Detection & Response:
7. Threat Hunt: Proactively search network logs for indicators of compromise (IoCs) from SOCRadar's published FortiBleed infrastructure list.
8. EDR Deployment: Deploy endpoint detection and response (EDR) solutions across servers accessible from FortiGate to catch credential-harvesting attempts and reconnaissance activity.
9. Ransomware Monitoring: Monitor for file encryption activity, suspicious PowerShell execution, and connections to known INC Ransom or Lynx command-and-control infrastructure.
## References
---
## HackWire Analysis
FortiBleed represents a watershed moment in ransomware operations: the first time a large-scale credential-harvesting campaign has been conclusively linked to active ransomware deployments by multiple groups. What's striking is not just the scale—110 million credentials and 430,000 targeted firewalls—but the *efficiency* of the conversion pipeline. Only 0.09% of globally scanned FortiGate appliances needed to be successfully compromised to fuel ransomware attacks against 354 organizations. That conversion rate speaks to a mature, well-resourced operation.
The attribution to a Russian-speaking initial access broker (IAB) with an internal team of ~20 specialists signals professionalization in the ransomware-as-a-service ecosystem. This isn't ad-hoc cybercriminals—it's an organized operation with clear division of labor: lead operators handling high-impact intrusions, backed by specialists and support staff. That structure mirrors the hierarchies we've observed in other nation-state-adjacent groups, and it suggests this team isn't going away after exposure. They'll simply rotate infrastructure and retarget.
Critically, the actors also possess a zero-day in Nextcloud, currently being coordinated with the vendor. That's a second lever for breaking into enterprise environments—one that doesn't rely on the FortiGate compromises. The simultaneous discovery of both Nextcloud and FortiClient EMS vulnerabilities being exploited by the same operators indicates they've likely stockpiled additional zero-days for follow-on campaigns.
For defenders: assume that if your FortiGate was internet-facing anytime in the past six months, your credentials are compromised. Patch immediately, rotate passwords, and hunt for evidence of packet sniffers or suspicious system processes. For security teams in LATAM and APAC specifically—manufacturing, logistics, and tech—this campaign had you in its crosshairs. Treat this as a direct attack and respond accordingly.
— *HackWire Editorial*
## Related Coverage