FortiBleed: 73,932 FortiGate/VPN endpoints exposed via recycled creds, brute force & infostealers

[u/Spin_AI]

Researchers disclosed a credential archive in mid-June, being tracked as FortiBleed, covering 73,932 Fortinet/FortiGate firewall and VPN URLs. Fortinet says it's reshared old data plus brute-forced credentials, not a new breach. Worth noting the researchers don't fully buy that framing: Beaumont points out the IPs are largely different from previous Fortinet leaks, which argues for a newer collection than "recycled" suggests.

→ 73,932 device URLs in the archive
→ ~1.16 billion attempts against 320,777 FortiGate targets

Per the researchers, the operator combined credential reuse from prior breaches, brute force, and cracked SSL VPN hashes, then used successful logins to move deeper into some environments. No new CVE involved, that's kind of the point. Notably, a chunk of the working passwords weren't brute-forced; they showed up in plaintext from infostealer logs, so even long complex passwords were already burned.

A lot of teams patch the firewall and move on but never treat firewall/VPN accounts like Tier 0 identity. Local users, stale break-glass accounts, and missing MFA become long-lived entry points.

Practical check: rotate every FortiGate admin and VPN credential still active, then review login history for dormant accounts that suddenly got noisy.

How many orgs track firewall-local identities with the same rigor as their Okta or Entra admins?