Fortibleed: How 75,000 FortiGate Firewalls Ended Up on an Attacker's Credential List

Somebody built a pipeline. Not a glamorous zero-day drop — a methodical, highly automated operation that collected FortiGate configuration files from internet-exposed devices, cracked the password hashes inside them, and assembled a working credential list covering somewhere around 75,000 firewalls across 194 countries.

That number comes from independent analysis by researchers including Kevin Beaumont and Hudson Rock, and it puts roughly half of all internet-facing Fortinet firewalls visible on Shodan inside this dataset. SOCRadar, which discovered an operational server belonging to an unnamed threat actor, puts the figure closer to 30,000 confirmed working credentials — but both numbers are bad.

The failure mode here is layered. Fortinet moved to PBKDF2-based password hashing in FortiOS 7.2.11, 7.4.8, and 7.6.1, replacing the legacy SHA-256-with-salt approach. The problem, as Arctic Wolf researchers flagged in a post, is that upgrading FortiOS does not automatically re-hash existing admin credentials. Those hashes stay as SHA-256 until the admin physically logs in after the upgrade. In practice, that means plenty of organizations running current-ish firmware are still storing crackable credentials because nobody clicked login on the new version.

Offline SHA-256 cracking is not hard. It is fast, cheap, and trivially parallelizable on GPU clusters. An attacker who gets a config file gets a solvable puzzle.

The initial access vector for the config file exfiltration remains unconfirmed. WatchTowr CEO Benjamin Harris offered the framing that matters most operationally: these credentials were probably accumulated across multiple Fortinet CVEs over an extended period, retaining value long after patches were applied. That is a different threat model than a smash-and-grab exploit. The dataset is a durable asset.

SOCRadar assessed the tooling and targeting as consistent with Russian-speaking threat actors. Attribution is ongoing.

The blast radius if those credentials get used is exactly what you'd expect. Beaumont noted that an attacker with valid FortiGate admin credentials can log in remotely, gain access to the network behind the firewall, modify security controls, and create backdoor accounts. That is full perimeter ownership without ever touching an endpoint.

Top affected countries by credential count are India, the US, and Mexico. The credential breakdown skews toward organization-specific accounts, which points at deliberate enterprise targeting rather than opportunistic spray.

Fortinet had not commented publicly at time of writing.

The immediate remediation checklist is short: rotate all admin and VPN credentials on affected FortiGate devices now, enforce MFA on management interfaces, pull those interfaces off the public internet if you haven't already, and — critically — force every administrator to log in once after upgrading FortiOS so the re-hashing actually happens. A super_admin account can also trigger manual password updates to force the PBKDF2 migration.

Assume the credentials in any exposed config file are already burned.

Operational takeaway: If your FortiGate admins haven't logged in since you patched, you're still running SHA-256 hashes regardless of what your firmware version says.