[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjVj14ie98UBdH7TLdnWHEBBWT4W43lwv_TTJAZgVvqo":3,"$fEE71EF1Miqt5NwWNzWQMYH7ExSif1gKsin4t-p__Mks":29},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":14,"hero_image_url":15,"structured":16,"story_type":25,"created_at":26,"updated_at":27,"published_at":28},"fortibleed-75k-fortinet-fortigate-firewalls-with-cracked-admin-passwords-leaked-","FortiBleed: 75k Fortinet FortiGate firewalls with cracked admin passwords leaked by Russian ransomware group","FortiBleed exposes 75,000 Fortinet FortiGate firewalls with cracked admin passwords, with a Russian ransomware group behind the credential harvesting and GPU brute-forcing.","FortiBleed leaks 75,000 Fortinet FortiGate firewalls with cracked admin passwords, with a Russian ransomware group behind the credential harvesting and GPU brute-forcing.",[10,11,12,13,10],"FortiBleed","Fortinet","FortiGate","Ransomware","# FortiBleed: 75k Fortinet FortiGate firewalls with cracked admin passwords leaked by Russian ransomware group\n\n*FortiBleed exposes 75,000 Fortinet FortiGate firewalls with cracked admin passwords, with a Russian ransomware group behind the credential harvesting and GPU brute-forcing.*\n\n**Tags:** `FortiBleed` `Fortinet` `FortiGate` `Ransomware` `FortiBleed`\n\n> FortiBleed leaks 75,000 Fortinet FortiGate firewalls with cracked admin passwords, with a Russian ransomware group behind the credential harvesting and GPU brute-forcing.\n\n---\n\n## FortiBleed: 75k Fortinet firewalls with cracked admin passwords leaked\n\nFortinet FortiGate firewalls are being exposed at scale. A Russian ransomware group has cracked admin passwords on roughly 75,000 internet-facing devices and is now leaking the credentials, according to a new disclosure from CloudSEK.\n\nThe attacker, dubbed FortiBleed, harvested the admin credentials and ran them through GPU brute-forcing to recover plaintext passwords. The group then backdoored the devices with dormant admin accounts before publishing the full list, giving them a persistent foothold for lateral movement into internal Active Directory environments.\n\n## How the attacker cracked the passwords\n\nThe attacker ran the harvested admin credentials through a GPU-powered brute-force to recover the plaintext passwords. The group rented compute to handle the volume, a common move for eCrime operations that need to crack thousands of FortiGate admin hashes in a single pass. The same password strings appear across multiple victims because the group backdoored the devices earlier in the campaign, planting dormant admin accounts with reused credentials. That reuse is what lets them pivot laterally into internal Active Directory once the FortiGate is in the network. The financial motive is straightforward: they pay for GPU time to crack the passwords, then sell or leak the credentials for profit.\n\n## Who was hit\n\nThe primary victims are Managed Service Providers and telecommunications operators running FortiGate firewalls as their internet-facing edge. The attacker targeted roughly 75,000 devices, harvesting admin credentials from each and running them through GPU brute-force to recover plaintext passwords.\n\nOnce the FortiGate is in the network, the group pivots laterally into internal Active Directory environments. The same password strings appear across multiple victims because the group backdoored the devices earlier in the campaign, planting dormant admin accounts with reused credentials. That reuse is what enables the lateral movement into the AD domain once the firewall is compromised.\n\n## The Russian ransomware group\n\nThis is an eCrime group, not a nation-state. The operation is financially motivated: it rents GPU compute to brute-force the FortiGate admin hashes, then sells or leaks the recovered credentials for profit. The same password strings reused across multiple victims come from a single Russian ransomware group that had already backdoored the devices with dormant admin accounts earlier in the campaign.\n\nThe security posture is sloppy enough to read as 'Advanced Persistent Teenagers' rather than a mature state actor. The group runs as a Ransomware-as-a-Service operation, with recruitment posts and forum activity conducted in Russian. That is the standard eCrime pattern: rent the GPUs, crack the hashes, plant the backdoor, and publish the list when the volume is high enough to hurt.\n\n## Key points\n\n- FortiBleard leaks 75,000 Fortinet FortiGate firewalls with cracked admin passwords\n- A Russian ransomware group is behind the credential harvesting and GPU brute-forcing\n- The group is using the same passwords across victims, backdooring devices with dormant admin accounts\n- The directory contains direct evidence of access to internal Active Directory environments at a reasonable number of companies\n- The attacker is an eCrime group with a financial motivation, renting GPUs to crack passwords\n\n## Further reading & sources\n\n- [Medium](https:\u002F\u002Fdoublepulsar.com\u002Fan-update-on-fortibleed-whats-happening-with-victim-orgs-c0671a50e7f4) — DoublePulsar (Kevin Beaumont)\n- [Sicarii Ransomware: Truth vs Myth - Check Point Research](https:\u002F\u002Fresearch.checkpoint.com\u002F2026\u002Fsicarii-ransomware-truth-vs-myth)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortibleed-75k-fortinet-fortigate-firewalls-with-cracked-admin-passwords-leaked-.png?v=833e970a32",{"timeline":17,"technologies":22},[18],{"date":19,"event":20,"description":21},"2026-06-17","Initial Report","Author wrote initial post about FortiBleed two days before the current article date.",[23],{"vendor":11,"product":24},"Fortigate Firewall","data_leak","2026-08-29T17:11:59.60041+00:00","2026-10-16T12:29:02.265164+00:00",null,{"articles":30},[31,43,54,67],{"slug":32,"title":33,"summary":34,"tags":35,"hero_image_url":40,"story_type":41,"created_at":42},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","StormEncryptor ransomware deployed via N-central auth-bypass CVE-2026-18577","A former Medusa affiliate (Storm-1175) is actively deploying StormEncryptor ransomware through an incomplete patch for CVE-2026-18556 in N-able N-central, allowing unauthenticated remote attackers to bypass authentication and take over the RMM server to reach managed endpoints.",[36,37,38,13,39],"N-able N-central","CVE-2026-18577","StormEncryptor","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","ransomware_incident","2026-09-24T07:05:56.501709+00:00",{"slug":44,"title":45,"summary":46,"tags":47,"hero_image_url":52,"story_type":41,"created_at":53},"dragonforce-ransomware-hits-saudi-chemical-manufacturer","DragonForce Ransomware Hits Saudi Chemical Manufacturer","The DragonForce ransomware group has claimed a Saudi Arabian chemical manufacturer, adding to its Q2 2026 run of 144 victims and its ongoing campaign against Gulf-region industrial targets.",[48,13,49,50,51],"DragonForce","Saudi Arabia","Chemical Manufacturing","ASEC","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdragonforce-ransomware-hits-saudi-chemical-manufacturer.png?v=789ad783bf","2026-09-19T12:09:53.129912+00:00",{"slug":55,"title":56,"summary":57,"tags":58,"hero_image_url":64,"story_type":65,"created_at":66},"ahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-","AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'","AhnLab ASEC and four Korean government agencies jointly published 'Operation Double Barrel,' revealing a state-sponsored actor that has continuously distributed malware through Korean financial security software vulnerabilities since 2025 and linking it to the Gunra ransomware group through shared initial access, backdoors, SSH fingerprints, and C2 infrastructure.",[59,60,61,62,63,13],"Gunra","AhnLab ASEC","Operation Double Barrel","FortiOS","FortiProxy","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-.png?v=579bc98ad5","threat_actor_activity","2026-09-18T07:15:06.272711+00:00",{"slug":68,"title":69,"summary":70,"tags":71,"hero_image_url":75,"story_type":41,"created_at":76},"qilin-ransomware-tops-june-2026-with-83-cases-41-manufacturing-hits-92-us-victim","Qilin Ransomware Tops June 2026 with 83 Cases, 41 Manufacturing Hits, 92 US Victims","AhnLab ASEC's June 2026 Ransomware Trend Report shows Qilin as the most active group with 83 cases, 41 manufacturing incidents, and 92 US hits, while also targeting Musashino University, ISUZU Motors, and the Central Bank of Libya.",[72,13,60,73,74],"Qilin","Manufacturing","US","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fqilin-ransomware-tops-june-2026-with-83-cases-41-manufacturing-hits-92-us-victim.png?v=b915ec283d","2026-09-18T07:07:39.952851+00:00"]