FortiBleed: 75k Fortinet firewalls with cracked admin passwords leaked
Fortinet FortiGate firewalls are being exposed at scale. A Russian ransomware group has cracked admin passwords on roughly 75,000 internet-facing devices and is now leaking the credentials, according to a new disclosure from CloudSEK.
The attacker, dubbed FortiBleed, harvested the admin credentials and ran them through GPU brute-forcing to recover plaintext passwords. The group then backdoored the devices with dormant admin accounts before publishing the full list, giving them a persistent foothold for lateral movement into internal Active Directory environments.
How the attacker cracked the passwords
The attacker ran the harvested admin credentials through a GPU-powered brute-force to recover the plaintext passwords. The group rented compute to handle the volume, a common move for eCrime operations that need to crack thousands of FortiGate admin hashes in a single pass. The same password strings appear across multiple victims because the group backdoored the devices earlier in the campaign, planting dormant admin accounts with reused credentials. That reuse is what lets them pivot laterally into internal Active Directory once the FortiGate is in the network. The financial motive is straightforward: they pay for GPU time to crack the passwords, then sell or leak the credentials for profit.
Who was hit
The primary victims are Managed Service Providers and telecommunications operators running FortiGate firewalls as their internet-facing edge. The attacker targeted roughly 75,000 devices, harvesting admin credentials from each and running them through GPU brute-force to recover plaintext passwords.
Once the FortiGate is in the network, the group pivots laterally into internal Active Directory environments. The same password strings appear across multiple victims because the group backdoored the devices earlier in the campaign, planting dormant admin accounts with reused credentials. That reuse is what enables the lateral movement into the AD domain once the firewall is compromised.
The Russian ransomware group
This is an eCrime group, not a nation-state. The operation is financially motivated: it rents GPU compute to brute-force the FortiGate admin hashes, then sells or leaks the recovered credentials for profit. The same password strings reused across multiple victims come from a single Russian ransomware group that had already backdoored the devices with dormant admin accounts earlier in the campaign.
The security posture is sloppy enough to read as 'Advanced Persistent Teenagers' rather than a mature state actor. The group runs as a Ransomware-as-a-Service operation, with recruitment posts and forum activity conducted in Russian. That is the standard eCrime pattern: rent the GPUs, crack the hashes, plant the backdoor, and publish the list when the volume is high enough to hurt.
Key points
- FortiBleard leaks 75,000 Fortinet FortiGate firewalls with cracked admin passwords
- A Russian ransomware group is behind the credential harvesting and GPU brute-forcing
- The group is using the same passwords across victims, backdooring devices with dormant admin accounts
- The directory contains direct evidence of access to internal Active Directory environments at a reasonable number of companies
- The attacker is an eCrime group with a financial motivation, renting GPUs to crack passwords
Further reading & sources
- Medium — DoublePulsar (Kevin Beaumont)
- Sicarii Ransomware: Truth vs Myth - Check Point Research