Fortibleed: How 75,000 FortiGate Firewalls Ended Up on an Attacker's Credential List

Key points

• Researchers place the Fortibleed dataset at roughly 75,000 internet-facing FortiGate firewalls across 194 countries.
• SOCRadar found over 30,791 confirmed working credentials on an attacker-controlled server with its own automation tooling.
• Upgrading FortiOS does not automatically re-hash admin credentials; SHA-256 hashes persist until each admin logs in after the upgrade.
• WatchTowr CEO Benjamin Harris says these credentials were likely harvested across multiple Fortinet CVEs over time, not a single exploit.
• Rotate admin and VPN credentials now, enforce MFA on management interfaces, and force every admin to log in once post-upgrade.

Somebody built a pipeline. Not a glamorous zero-day drop, a methodical, highly automated operation that collected FortiGate configuration files from internet-exposed devices, cracked the password hashes inside, and assembled a working credential list covering roughly 75,000 firewalls across 194 countries.

That number comes from independent analysis by researchers including Kevin Beaumont and Hudson Rock. It puts about half of all internet-facing Fortinet firewalls visible on Shodan inside this dataset. SOCRadar, which discovered an operational server belonging to an unnamed threat actor, puts confirmed working credentials at over 30,791 devices. Both figures are bad.

Why are these hashes so easy to crack?

Fortinet introduced PBKDF2-based password hashing in FortiOS 7.2.11, 7.4.8, and 7.6.1, replacing the older SHA-256-with-salt approach. Arctic Wolf researchers flagged the catch: upgrading FortiOS does not automatically re-hash existing admin credentials. Those hashes stay SHA-256 until the admin physically logs in after the upgrade. Plenty of organizations on current firmware are still storing crackable credentials because nobody clicked login on the new version. Offline SHA-256 cracking is fast and trivially parallelizable on GPU clusters. An attacker with a config file has a solvable puzzle.

The initial access vector for config file exfiltration remains unconfirmed. WatchTowr CEO Benjamin Harris put it plainly: "The uncomfortable reality is that modern exploitation isn't always about immediate impact. It's about harvesting data that retains value long after the underlying vulnerability has been patched." The dataset is a durable asset, not a smash-and-grab. Our earlier story on a live Fortinet credential-theft vector from 28 May showed this pattern forming.

Should you worry about attribution?

SOCRadar assessed the tooling and targeting as consistent with Russian-speaking threat actors. Attribution is ongoing.

What can an attacker actually do with these credentials?

Full perimeter ownership without touching an endpoint. Beaumont noted that valid FortiGate admin credentials let an attacker log in remotely, reach the network behind the firewall, modify security controls, and create backdoor accounts.

Top affected countries are India, the US, and Mexico, with just under 12,000 compromised credentials between them. The credential breakdown skews toward organization-specific accounts, pointing at deliberate enterprise targeting. Fortinet had not commented publicly at time of writing.

What should you do right now?

Rotate all admin and VPN credentials on affected FortiGate devices. Enforce MFA on management interfaces and pull those interfaces off the public internet. Force every administrator to log in once after upgrading FortiOS so the PBKDF2 re-hash actually happens. A super_admin account can also trigger manual password updates to force the migration.

Assume the credentials in any exposed config file are already burned.

Operational takeaway: If your FortiGate admins haven't logged in since you patched, you're still running SHA-256 hashes regardless of what your firmware version says.